Overview

overview

7

Static

static

3

12fc003ecc...4e.exe

windows10-2004-x64

7

12fc003ecc...4e.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    127s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/10/2026, 10:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
  • Size 5.4MB
  • Sample261002-mlfbwsgc95
  • SHA256 12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
    "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3508
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3E28.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2756
      • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
        "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:3384
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4145.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:5940
          • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
            "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:4948
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4404.bat
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:5012
              • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:4700
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4750.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4812
                  • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                    "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:2232
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4982.bat
                      10⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:3528
                      • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                        "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of WriteProcessMemory
                        PID:2788
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4CDE.bat
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:6096
                          • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                            "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of WriteProcessMemory
                            PID:5412
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F4F.bat
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:4344
                              • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:2612
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a523D.bat
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:2368
                                  • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                    "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious use of WriteProcessMemory
                                    PID:6032
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5654.bat
                                      18⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:5676
                                      • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                        "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:3272
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6066.bat
                                          20⤵
                                            PID:2568
                                            • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                              "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                              21⤵
                                              • Executes dropped EXE
                                              • Drops file in Windows directory
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:5432
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a62F6.bat
                                                22⤵
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of WriteProcessMemory
                                                PID:3448
                                                • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                  23⤵
                                                  • Executes dropped EXE
                                                  • Drops file in Windows directory
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:5612
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a70B2.bat
                                                    24⤵
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:2892
                                                    • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                      25⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:5540
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A18.bat
                                                        26⤵
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2928
                                                        • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                          27⤵
                                                          • Executes dropped EXE
                                                          • Drops file in Windows directory
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:5904
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7CD7.bat
                                                            28⤵
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2248
                                                            • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                              29⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:5980
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a82E2.bat
                                                                30⤵
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:1756
                                                                • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                  31⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:4068
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a85B1.bat
                                                                    32⤵
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:2436
                                                                    • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                      33⤵
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:1848
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8812.bat
                                                                        34⤵
                                                                        • Executes a command shell one-liner
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:4984
                                                                        • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                          35⤵
                                                                          • Executes dropped EXE
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:2292
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9178.bat
                                                                            36⤵
                                                                            • Executes a command shell one-liner
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:2032
                                                                            • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                              37⤵
                                                                              • Executes dropped EXE
                                                                              • Drops file in Windows directory
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:3124
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9428.bat
                                                                                38⤵
                                                                                • Executes a command shell one-liner
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:3852
                                                                                • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                  39⤵
                                                                                  • Executes dropped EXE
                                                                                  • Drops file in Windows directory
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:5220
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a96D7.bat
                                                                                    40⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:2440
                                                                                    • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                      41⤵
                                                                                      • Executes dropped EXE
                                                                                      • Drops file in Windows directory
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:2720
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9996.bat
                                                                                        42⤵
                                                                                        • Executes a command shell one-liner
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:4116
                                                                                        • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                          43⤵
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:1112
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9BB9.bat
                                                                                            44⤵
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:2216
                                                                                            • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                              45⤵
                                                                                              • Executes dropped EXE
                                                                                              • Drops file in Windows directory
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:792
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D01.bat
                                                                                                46⤵
                                                                                                • Executes a command shell one-liner
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:5544
                                                                                                • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                  47⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Drops file in Windows directory
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:5240
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9DDC.bat
                                                                                                    48⤵
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:952
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                      49⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:2840
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9EA7.bat
                                                                                                        50⤵
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:1776
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                          51⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:1724
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F92.bat
                                                                                                            52⤵
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:2344
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                              53⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Drops file in Windows directory
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:5580
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA05D.bat
                                                                                                                54⤵
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:1760
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                  55⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:3220
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA176.bat
                                                                                                                    56⤵
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:1912
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                      57⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Drops file in Windows directory
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:5144
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA232.bat
                                                                                                                        58⤵
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:2472
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                          59⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:2020
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA2FD.bat
                                                                                                                            60⤵
                                                                                                                            • Executes a command shell one-liner
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:5332
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                              61⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                              PID:4808
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA3F7.bat
                                                                                                                                62⤵
                                                                                                                                • Executes a command shell one-liner
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                PID:2068
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:3196
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA4D1.bat
                                                                                                                                    64⤵
                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                    PID:1768
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      PID:1680
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA59D.bat
                                                                                                                                        66⤵
                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                        PID:2512
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                          67⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:712
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA697.bat
                                                                                                                                            68⤵
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:2740
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                              69⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:5960
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA781.bat
                                                                                                                                                70⤵
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:3316
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                  71⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:4668
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA86B.bat
                                                                                                                                                    72⤵
                                                                                                                                                      PID:3432
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                        73⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:4896
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA917.bat
                                                                                                                                                          74⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:5504
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                            75⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:2712
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA21.bat
                                                                                                                                                              76⤵
                                                                                                                                                                PID:4844
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                  77⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:4336
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAAEC.bat
                                                                                                                                                                    78⤵
                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                    PID:5008
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                      79⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      PID:1764
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aABD6.bat
                                                                                                                                                                        80⤵
                                                                                                                                                                          PID:3076
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                            81⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            PID:5200
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aACD0.bat
                                                                                                                                                                              82⤵
                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                              PID:4752
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                83⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                PID:2988
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aADAB.bat
                                                                                                                                                                                  84⤵
                                                                                                                                                                                    PID:5452
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                      85⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:3092
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE95.bat
                                                                                                                                                                                        86⤵
                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                        PID:2556
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                          87⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                          PID:5588
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF61.bat
                                                                                                                                                                                            88⤵
                                                                                                                                                                                              PID:4696
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                89⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                PID:2992
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB04B.bat
                                                                                                                                                                                                  90⤵
                                                                                                                                                                                                    PID:4856
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                      91⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      PID:1604
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB145.bat
                                                                                                                                                                                                        92⤵
                                                                                                                                                                                                          PID:5868
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                            93⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            PID:5928
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB210.bat
                                                                                                                                                                                                              94⤵
                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                              PID:464
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                95⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                PID:604
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB2FA.bat
                                                                                                                                                                                                                  96⤵
                                                                                                                                                                                                                    PID:3440
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                      97⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      PID:2872
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB404.bat
                                                                                                                                                                                                                        98⤵
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        PID:4416
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                          99⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:1220
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB4DF.bat
                                                                                                                                                                                                                            100⤵
                                                                                                                                                                                                                              PID:4520
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                101⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                PID:5180
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB5AA.bat
                                                                                                                                                                                                                                  102⤵
                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                  PID:5076
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                    103⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    PID:1100
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB675.bat
                                                                                                                                                                                                                                      104⤵
                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                      PID:2108
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                        105⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        PID:2532
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB731.bat
                                                                                                                                                                                                                                          106⤵
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          PID:5968
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                            107⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            PID:2792
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB81B.bat
                                                                                                                                                                                                                                              108⤵
                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:5828
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                109⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                PID:1696
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB8D6.bat
                                                                                                                                                                                                                                                  110⤵
                                                                                                                                                                                                                                                    PID:5212
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                      111⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      PID:2204
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB982.bat
                                                                                                                                                                                                                                                        112⤵
                                                                                                                                                                                                                                                          PID:5464
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                            113⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            PID:4108
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA5D.bat
                                                                                                                                                                                                                                                              114⤵
                                                                                                                                                                                                                                                                PID:3876
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                  115⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                  PID:1232
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB19.bat
                                                                                                                                                                                                                                                                    116⤵
                                                                                                                                                                                                                                                                      PID:3752
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                        117⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        PID:4600
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBBC4.bat
                                                                                                                                                                                                                                                                          118⤵
                                                                                                                                                                                                                                                                            PID:5856
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                              119⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              PID:4936
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBCAF.bat
                                                                                                                                                                                                                                                                                120⤵
                                                                                                                                                                                                                                                                                  PID:3104
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                    121⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                    PID:3300
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD5B.bat
                                                                                                                                                                                                                                                                                      122⤵
                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                      PID:5548
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                        123⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                        PID:4888
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE16.bat
                                                                                                                                                                                                                                                                                          124⤵
                                                                                                                                                                                                                                                                                            PID:4220
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                              125⤵
                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                              PID:4744
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBEF1.bat
                                                                                                                                                                                                                                                                                                126⤵
                                                                                                                                                                                                                                                                                                  PID:5052
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                    127⤵
                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                    PID:3656
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBFDB.bat
                                                                                                                                                                                                                                                                                                      128⤵
                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                      PID:3756
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                        129⤵
                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                        PID:3036
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC087.bat
                                                                                                                                                                                                                                                                                                          130⤵
                                                                                                                                                                                                                                                                                                            PID:5132
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                              131⤵
                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                              PID:2572
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC181.bat
                                                                                                                                                                                                                                                                                                                132⤵
                                                                                                                                                                                                                                                                                                                  PID:1156
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                    133⤵
                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                    PID:2560
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC26C.bat
                                                                                                                                                                                                                                                                                                                      134⤵
                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                      PID:5256
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                        135⤵
                                                                                                                                                                                                                                                                                                                          PID:2168
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC356.bat
                                                                                                                                                                                                                                                                                                                            136⤵
                                                                                                                                                                                                                                                                                                                              PID:4524
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                137⤵
                                                                                                                                                                                                                                                                                                                                  PID:5140
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC411.bat
                                                                                                                                                                                                                                                                                                                                    138⤵
                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                    PID:2408
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                      139⤵
                                                                                                                                                                                                                                                                                                                                        PID:5276
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC4EC.bat
                                                                                                                                                                                                                                                                                                                                          140⤵
                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                          PID:4500
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                            141⤵
                                                                                                                                                                                                                                                                                                                                              PID:3000
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC5A8.bat
                                                                                                                                                                                                                                                                                                                                                142⤵
                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                PID:996
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                  143⤵
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:4848
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC692.bat
                                                                                                                                                                                                                                                                                                                                                    144⤵
                                                                                                                                                                                                                                                                                                                                                      PID:4964
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                        145⤵
                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                        PID:5472
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC74E.bat
                                                                                                                                                                                                                                                                                                                                                          146⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                          PID:760
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                            147⤵
                                                                                                                                                                                                                                                                                                                                                              PID:4836
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC7F9.bat
                                                                                                                                                                                                                                                                                                                                                                148⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                PID:1468
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                  149⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:4792
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC8E4.bat
                                                                                                                                                                                                                                                                                                                                                                      150⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:2528
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                          151⤵
                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                          PID:4584
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC990.bat
                                                                                                                                                                                                                                                                                                                                                                            152⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                            PID:3964
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                              153⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:1500
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA5B.bat
                                                                                                                                                                                                                                                                                                                                                                                  154⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:4532
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                    155⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                    PID:3652
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB16.bat
                                                                                                                                                                                                                                                                                                                                                                                      156⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:3148
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                          157⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:2348
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC10.bat
                                                                                                                                                                                                                                                                                                                                                                                              158⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:4928
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  159⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                  PID:5660
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD1A.bat
                                                                                                                                                                                                                                                                                                                                                                                                    160⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3812
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      161⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5680
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCDF5.bat
                                                                                                                                                                                                                                                                                                                                                                                                        162⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4952
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          163⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:5268
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCEB0.bat
                                                                                                                                                                                                                                                                                                                                                                                                              164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2500
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3204
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF9B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                      166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4252
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD095.bat
                                                                                                                                                                                                                                                                                                                                                                                                                            168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:828
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:912
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD150.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                  170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5296
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2696
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD20C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                          172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2000
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3924
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD2C7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5304
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4492
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD363.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                      176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1608
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2548
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD43E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                            178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3172
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6128
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD4DA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD596.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD661.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD71C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD7E8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD8C2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD96E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA1A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDAC6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDB72.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC2D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD08.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDDC4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE7F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF4A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE015.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE0F0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE1BB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE286.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE342.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE3FD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE4E8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE5B3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE69D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE749.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE833.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE90E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE9D9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEAA4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB50.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEC1B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED15.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEDE1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEEDB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEFB5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF061.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF13C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF226.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF301.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF3BD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF449.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF4D6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF572.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF61E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF6CA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF785.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF841.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF91C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF9E7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFAA2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFB7D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC29.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFCE4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFDA0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFE3C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFEF8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFF94.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a13A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1F5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a38B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              302⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  303⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a437.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    304⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        305⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4D4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          306⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            307⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a551.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                308⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  309⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5DD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      310⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        311⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1280
                                                                                                                                                                                                              • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                C:\Windows\Logo1_.exe
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Creates a file in the Startup directory
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                PID:4408
                                                                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                  net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                  PID:3216
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    PID:3048

                                                                                                                                                                                                            Network

                                                                                                                                                                                                                  MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                  Reconnaissance

                                                                                                                                                                                                                  Resource Development

                                                                                                                                                                                                                  Initial Access

                                                                                                                                                                                                                  Execution

                                                                                                                                                                                                                  Command and Scripting Interpreter

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1059

                                                                                                                                                                                                                  Windows Command Shell

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1059.003

                                                                                                                                                                                                                  Persistence

                                                                                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1547

                                                                                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1547.001

                                                                                                                                                                                                                  Privilege Escalation

                                                                                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1547

                                                                                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1547.001

                                                                                                                                                                                                                  Defense Evasion

                                                                                                                                                                                                                  Credential Access

                                                                                                                                                                                                                  Credentials from Password Stores

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1555

                                                                                                                                                                                                                  Credentials from Web Browsers

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1555.003

                                                                                                                                                                                                                  Unsecured Credentials

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1552

                                                                                                                                                                                                                  Credentials In Files

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1552.001

                                                                                                                                                                                                                  Discovery

                                                                                                                                                                                                                  Peripheral Device Discovery

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1120

                                                                                                                                                                                                                  Query Registry

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1012

                                                                                                                                                                                                                  System Information Discovery

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1082

                                                                                                                                                                                                                  System Location Discovery

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1614

                                                                                                                                                                                                                  System Language Discovery

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1614.001

                                                                                                                                                                                                                  System Network Configuration Discovery

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1016

                                                                                                                                                                                                                  Lateral Movement

                                                                                                                                                                                                                  Collection

                                                                                                                                                                                                                  Data from Local System

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1005

                                                                                                                                                                                                                  Command and Control

                                                                                                                                                                                                                  Exfiltration

                                                                                                                                                                                                                  Impact

                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                  $$a3E28.bat
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a3E28.bat
                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                  • SHA256 d84fbc8046bb5146c3860848dea1cf6dc7ef4e9206f69b97f98cfee9c9c1012c
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  $$a4145.bat
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a4145.bat
                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                  • SHA256 117d58a5357fe0c41d89651eea42882d3255e7376cabc683f0bf966779aa1369
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  $$a4404.bat
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a4404.bat
                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                  • SHA256 8f85b060fca40bbaea9c8ebc04cb84486f40be1b8301e484ff5ec8f2be8997e4
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  $$a4750.bat
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a4750.bat
                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                  • SHA256 056ce28c7a9c37d57e9968f8b82cd6455104657aec068a7b11cda07d99439ae4
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  $$a4982.bat
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a4982.bat
                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                  • SHA256 64bcaafe96519ee9ca8eac5fbaa8268477c09e7cb03811100876e30ffe78088e
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  $$a4CDE.bat
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a4CDE.bat
                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                  • SHA256 c033d38958debbd85e62b7da380f4bf8e384bf3c25009403431714fe2b4414cb
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  $$a4F4F.bat
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a4F4F.bat
                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                  • SHA256 bc016cad8755fbff8b2a8406bcaad38a6ca8cd58ae8dcc2efd1c2e9b2eb79920
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  $$a523D.bat
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a523D.bat
                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                  • SHA256 cde4d59187ad244419f850e141e7f10d855d41bd3c846bae6d186e27e3a464b0
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  $$a5654.bat
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a5654.bat
                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                  • SHA256 c05f963d023cffcc126142560b7eeb4acfe8cff07f5c2d80cef02885ea997406
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  $$a62F6.bat
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a62F6.bat
                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                  • SHA256 921ede6d09f0c3580b3b52b1855c43a6e1aed2105754e202a553fbd5c07a675f
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  $$a70B2.bat
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a70B2.bat
                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                  • SHA256 eb8d5547b0e57c0e5574d44e05b6d93e95a02341c81086f848caed4c168d5137
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  $$a7A18.bat
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a7A18.bat
                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                  • SHA256 540e272d81bd5f2d23cdf34f4dc55f2aca6029d8cdeeffa71c169c417f7182bb
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  $$a7CD7.bat
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a7CD7.bat
                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                  • SHA256 03fdad27706df14789d004ceced618b8827d1ff4eed158be55c5045c088fd400
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  $$a82E2.bat
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a82E2.bat
                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                  • SHA256 539888e64fad8b9ecc4f4bda0318e92f8949fc83d0ab16921c842f179ea746db
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  $$a85B1.bat
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a85B1.bat
                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                  • SHA256 98e1b47dfb35fd51ba8269207b24fca7ff31c2d86290d052d84b0e8439153892
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  $$a8812.bat
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a8812.bat
                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                  • SHA256 1ec4161617f8bb9e62914a912f4c91aaa6a39af55d17f0d75f34f0f4bcc7d7c8
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  $$a9178.bat
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a9178.bat
                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                  • SHA256 8cb47429a03ef45feba41b11167848148bc0afa57fefc8ee1a58b647ed4fcabf
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  $$a9428.bat
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a9428.bat
                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                  • SHA256 f4309078542bb53d45f9e24a567fe6c67ad9a2e684a477f6a6bc79f53317e7c5
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  $$a96D7.bat
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a96D7.bat
                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                  • SHA256 975143909dbac65b67e3e5ef652e0a5e903c006bff5b5e06722e533d68b7c2c6
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  $$a9996.bat
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a9996.bat
                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                  • SHA256 85313917aa7262b10d40dbb2860912a0469f6563d671a44c861fb57ff200b60f
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe
                                                                                                                                                                                                                  • Size 5.0MB
                                                                                                                                                                                                                  • SHA256 d9b5e914724aa9b9b5d4353685c19897bf77b11fd5b4847e5ed907f11b7ab034
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe.exe
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe.exe
                                                                                                                                                                                                                  • Size 5.0MB
                                                                                                                                                                                                                  • SHA256 025d2f4313665026a641e6e9ab91edbebbf0391bb85845f1bce90818a040906e
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe.exe
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe.exe
                                                                                                                                                                                                                  • Size 5.0MB
                                                                                                                                                                                                                  • SHA256 618204e88b6b7c50c46c3100c33348e4b017ad1c1d2b8f4b6980fe1b7996fd19
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe.exe
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe.exe
                                                                                                                                                                                                                  • Size 4.9MB
                                                                                                                                                                                                                  • SHA256 a353566253b437f3537857b13a1e272b682f2ce86c4b0784035b3ed1a7418b21
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe.exe
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe.exe
                                                                                                                                                                                                                  • Size 4.8MB
                                                                                                                                                                                                                  • SHA256 87be5ec1a425db2e1254b8329f6b0ffbfeda4b1c597cb1131c7cbba85ae8dc16
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe.exe
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe.exe
                                                                                                                                                                                                                  • Size 4.8MB
                                                                                                                                                                                                                  • SHA256 300f4ff5b6a742c8d5dc700af961d5a72cadf51eecec007139f185ecb63d595a
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe.exe
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe.exe
                                                                                                                                                                                                                  • Size 4.9MB
                                                                                                                                                                                                                  • SHA256 9ad675b603096115bb64808cf863a4c222ed18f3bf71c8f7643c72a3b437aac7
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe.exe
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe.exe
                                                                                                                                                                                                                  • Size 4.8MB
                                                                                                                                                                                                                  • SHA256 064dd46655a5d398a84f23d733377732644a948e7752727ac46b852c213c260c
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe.exe
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe.exe
                                                                                                                                                                                                                  • Size 4.7MB
                                                                                                                                                                                                                  • SHA256 0c2d43ba44e457ffcd16f12d36934938e7211819f095c42f5278a00655a76bb5
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe.exe
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe.exe
                                                                                                                                                                                                                  • Size 4.7MB
                                                                                                                                                                                                                  • SHA256 a0bf676aa4c0e54f41ac4f1962af06f8ae11d59d01103d136f1cb3133810db41
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe.exe
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe.exe
                                                                                                                                                                                                                  • Size 4.9MB
                                                                                                                                                                                                                  • SHA256 5fc720a0145faa88d2022fd046064100269e22458ebf1f9c12843f8511b9dfcc
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe.exe
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe.exe
                                                                                                                                                                                                                  • Size 5.1MB
                                                                                                                                                                                                                  • SHA256 dff614af2822d8b7b5722425fe3e296ed3fbb4dc5ed462c27b38692deb0ea0d7
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe.exe
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe.exe
                                                                                                                                                                                                                  • Size 5.2MB
                                                                                                                                                                                                                  • SHA256 62b2e89b57f030b36d4d0b093d50a85bcb2b41d305adcbf6fefc92ab17295fa1
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe.exe
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe.exe
                                                                                                                                                                                                                  • Size 5.0MB
                                                                                                                                                                                                                  • SHA256 418e02dd3474807f088615fe55891e43ed3ff4a0bae5f0e21163209bae80d4af
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe.exe
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe.exe
                                                                                                                                                                                                                  • Size 5.3MB
                                                                                                                                                                                                                  • SHA256 e703264e8d1bceeeef497321325b30a2f49a36c90c7a163f476705713dbf444d
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe.exe
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe.exe
                                                                                                                                                                                                                  • Size 5.3MB
                                                                                                                                                                                                                  • SHA256 f56721b780c9ab1e7a1bc92348e975242e96750912ca2b409f57e5112ce3c567
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe.exe
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe.exe
                                                                                                                                                                                                                  • Size 5.2MB
                                                                                                                                                                                                                  • SHA256 b06316129773ea98d142a883d2d42681c041995dca0d60940a11dcd63fb58167
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe.exe
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe.exe
                                                                                                                                                                                                                  • Size 5.1MB
                                                                                                                                                                                                                  • SHA256 c68ebb18b02121455657ae8e925a311b22b696e2b7c2db6ba86d442f39001e92
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe.exe
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe.exe
                                                                                                                                                                                                                  • Size 5.3MB
                                                                                                                                                                                                                  • SHA256 72fd5c1d70380f6e478158c81cf9c66945b63532b16cfc709a553cef7c8fbe56
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe.exe
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe.exe
                                                                                                                                                                                                                  • Size 5.2MB
                                                                                                                                                                                                                  • SHA256 9ec5f599fbc89a918ec9e24a123b2eabbf47990bfa1ef50ed3c366cf5257cd00
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe.exe
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\12fc003ecccfb90582d6260ae007a7239ae2f8f733251514c812fd138338774e.exe.exe
                                                                                                                                                                                                                  • Size 5.1MB
                                                                                                                                                                                                                  • SHA256 6ff17bd8b188d7fa481758d6f41f867ca7e7ddb44a56251f06c59775ccf26e5f
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  Logo1_.exe
                                                                                                                                                                                                                  • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                  • Size 32KB
                                                                                                                                                                                                                  • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  _desktop.ini
                                                                                                                                                                                                                  • Path F:\$RECYCLE.BIN\_desktop.ini
                                                                                                                                                                                                                  • Size 9B
                                                                                                                                                                                                                  • SHA256 66c5371c302c0168792bdad2070b6db71275df5a2ac194c19d038c7fdde2b7d6
                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  memory/248-8600-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/256-8951-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/420-8909-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/460-8643-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/604-8270-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/620-8867-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/700-8622-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/708-8720-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/712-8186-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/756-8593-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/792-8119-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/912-8516-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/1080-8980-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/1100-8295-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/1112-8113-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/1128-8734-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/1220-8283-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/1232-8331-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/1268-8699-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/1324-8748-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/1332-8874-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/1424-8572-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/1456-8727-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/1500-8460-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/1588-8671-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/1604-8258-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/1672-8629-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/1676-8973-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/1680-8180-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/1692-8607-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/1696-8313-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/1724-8137-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/1764-8222-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/1772-8825-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/1824-8713-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/1848-6097-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/1956-8776-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/2020-8161-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/2104-8615-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/2168-8397-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/2204-8319-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/2232-60-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/2292-7655-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/2348-8474-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/2532-8301-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/2548-8544-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/2560-8390-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/2572-8383-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/2612-93-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/2628-8797-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/2632-8706-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/2696-8523-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/2712-8210-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/2720-8105-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/2720-8163-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/2736-8987-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/2764-8685-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/2788-73-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/2788-3256-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/2792-8307-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/2796-8783-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/2840-8131-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/2872-8276-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/2988-8234-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/2992-8252-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/3000-8418-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/3016-8944-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/3036-8376-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/3092-8240-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/3120-8902-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/3124-8085-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/3136-8804-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/3196-8174-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/3204-8502-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/3220-8149-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/3256-8755-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/3272-1866-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/3300-8349-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/3380-8916-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/3384-24-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/3396-8839-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/3408-8692-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/3508-13-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/3508-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/3652-8467-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/3656-8369-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/3716-8657-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/3924-8530-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4068-6084-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4084-8853-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4092-8930-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4108-8325-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4208-8769-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4252-8509-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4256-8762-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4276-8636-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4336-8216-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4340-8811-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4360-8881-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4388-8741-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4408-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4408-1518-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4408-8278-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4408-6885-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4408-2123-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4464-8650-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4468-8832-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4492-8537-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4584-8453-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4596-8558-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4600-8337-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4664-8923-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4668-8198-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4676-8846-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4700-45-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4744-8362-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4760-8818-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4792-8446-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4800-8790-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4808-8168-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4836-8439-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4848-8425-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4888-8355-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4896-8204-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4936-8343-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4948-35-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5000-8937-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5080-8860-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5104-8586-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5140-8404-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5144-8155-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5180-8289-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5200-8228-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5220-8094-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5240-8125-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5268-8495-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5276-8411-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5356-8565-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5412-82-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5424-8579-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5432-1873-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5472-8432-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5528-8958-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5540-5596-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5580-8143-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5588-8246-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5612-3602-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5660-8481-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5680-8488-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5776-8678-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5812-8895-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5904-5605-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5928-8264-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5960-8192-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/5980-6075-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/6032-183-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/6052-8664-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/6068-8965-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/6112-8888-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/6128-8551-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                  Download