Overview

overview

7

Static

static

3

6e420c6535...7a.exe

windows10-2004-x64

7

6e420c6535...7a.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    127s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/10/2026, 11:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
  • Size 4.8MB
  • Sample261002-nms5ta1s8l
  • SHA256 6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
    "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4620
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2958.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4660
      • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
        "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1264
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D30.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4924
          • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
            "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:4112
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3203.bat
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4720
              • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:3696
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3493.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1892
                  • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                    "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:1972
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3762.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1424
                      • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                        "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:2904
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3A31.bat
                          12⤵
                          • Executes a command shell one-liner
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:1212
                          • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                            "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of WriteProcessMemory
                            PID:3632
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3CFF.bat
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:1084
                              • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:5828
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4099.bat
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:3668
                                  • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                    "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious use of WriteProcessMemory
                                    PID:4884
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4443.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:1664
                                      • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                        "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:3260
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4A3E.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:4892
                                          • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                            "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:6112
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5152.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • Suspicious use of WriteProcessMemory
                                              PID:2628
                                              • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of WriteProcessMemory
                                                PID:1560
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a548F.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:3448
                                                  • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4700
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B14.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4160
                                                      • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:480
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6D76.bat
                                                          28⤵
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:3284
                                                          • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:1740
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7229.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:6124
                                                              • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:5508
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a74B9.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:3472
                                                                  • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:4836
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a773A.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:3344
                                                                      • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:5476
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a83AD.bat
                                                                          36⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:1948
                                                                          • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:4116
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a85B1.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:3444
                                                                              • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:4372
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8851.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:4848
                                                                                  • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:260
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8AE1.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4656
                                                                                      • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:3788
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D61.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:5036
                                                                                          • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:2584
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E8A.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:2152
                                                                                              • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:1308
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F94.bat
                                                                                                  48⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:4976
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:3904
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a908E.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:920
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:4716
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a91A7.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:1428
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:1988
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a92A1.bat
                                                                                                              54⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:5456
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:5096
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a93AB.bat
                                                                                                                  56⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:4816
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:3648
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9486.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:724
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:2920
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9560.bat
                                                                                                                          60⤵
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:3240
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:3636
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a964B.bat
                                                                                                                              62⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:4432
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:2888
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9764.bat
                                                                                                                                  64⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:4544
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                    65⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Drops file in Windows directory
                                                                                                                                    PID:476
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a987D.bat
                                                                                                                                      66⤵
                                                                                                                                        PID:5032
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                          67⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          PID:2852
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a99A6.bat
                                                                                                                                            68⤵
                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                            PID:2136
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                              69⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:2884
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9AFE.bat
                                                                                                                                                70⤵
                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:3296
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                  71⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                  PID:4212
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C07.bat
                                                                                                                                                    72⤵
                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                    PID:2828
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                      73⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:2844
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D01.bat
                                                                                                                                                        74⤵
                                                                                                                                                          PID:800
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                            75⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            PID:3400
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9DDC.bat
                                                                                                                                                              76⤵
                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                              PID:4240
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                77⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                PID:1660
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9ED6.bat
                                                                                                                                                                  78⤵
                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                  PID:1076
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                    79⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:1324
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9FB1.bat
                                                                                                                                                                      80⤵
                                                                                                                                                                        PID:4148
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                          81⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                          PID:6104
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA0CA.bat
                                                                                                                                                                            82⤵
                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                            PID:4984
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                              83⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                              PID:2412
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA1A5.bat
                                                                                                                                                                                84⤵
                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                PID:4736
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                  85⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                  PID:5104
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA260.bat
                                                                                                                                                                                    86⤵
                                                                                                                                                                                      PID:2176
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                        87⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:2728
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA35A.bat
                                                                                                                                                                                          88⤵
                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                          PID:3888
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                            89⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            PID:3912
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA426.bat
                                                                                                                                                                                              90⤵
                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:4792
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                91⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                PID:5984
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA500.bat
                                                                                                                                                                                                  92⤵
                                                                                                                                                                                                    PID:4888
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                      93⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      PID:2660
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA5EB.bat
                                                                                                                                                                                                        94⤵
                                                                                                                                                                                                          PID:1840
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                            95⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            PID:4524
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA6D5.bat
                                                                                                                                                                                                              96⤵
                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:1416
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                97⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                PID:4180
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA791.bat
                                                                                                                                                                                                                  98⤵
                                                                                                                                                                                                                    PID:2060
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                      99⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                      PID:5552
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA86B.bat
                                                                                                                                                                                                                        100⤵
                                                                                                                                                                                                                          PID:5048
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                            101⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                            PID:4100
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA956.bat
                                                                                                                                                                                                                              102⤵
                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                              PID:1828
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                103⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                PID:2320
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA5F.bat
                                                                                                                                                                                                                                  104⤵
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:712
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                    105⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    PID:3316
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB59.bat
                                                                                                                                                                                                                                      106⤵
                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                      PID:3664
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                        107⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                        PID:5408
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC34.bat
                                                                                                                                                                                                                                          108⤵
                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                          PID:1684
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                            109⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                            PID:4896
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD2E.bat
                                                                                                                                                                                                                                              110⤵
                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                              PID:4856
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                111⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                PID:1944
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE47.bat
                                                                                                                                                                                                                                                  112⤵
                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                  PID:4952
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                    113⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:1348
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF41.bat
                                                                                                                                                                                                                                                      114⤵
                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                      PID:3528
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                        115⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        PID:1512
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB03B.bat
                                                                                                                                                                                                                                                          116⤵
                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                          PID:5392
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                            117⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            PID:1496
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB106.bat
                                                                                                                                                                                                                                                              118⤵
                                                                                                                                                                                                                                                                PID:2432
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                  119⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  PID:4992
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB210.bat
                                                                                                                                                                                                                                                                    120⤵
                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:5732
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                      121⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      PID:3252
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB2CC.bat
                                                                                                                                                                                                                                                                        122⤵
                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                        PID:6116
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                          123⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:3048
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB404.bat
                                                                                                                                                                                                                                                                            124⤵
                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            PID:4560
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                              125⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              PID:4636
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB51D.bat
                                                                                                                                                                                                                                                                                126⤵
                                                                                                                                                                                                                                                                                  PID:2848
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                    127⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    PID:1880
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB608.bat
                                                                                                                                                                                                                                                                                      128⤵
                                                                                                                                                                                                                                                                                        PID:5144
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                          129⤵
                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                          PID:5940
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB6D3.bat
                                                                                                                                                                                                                                                                                            130⤵
                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                            PID:2264
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                              131⤵
                                                                                                                                                                                                                                                                                                PID:4980
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB79E.bat
                                                                                                                                                                                                                                                                                                  132⤵
                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                  PID:1044
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                    133⤵
                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                    PID:4772
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB879.bat
                                                                                                                                                                                                                                                                                                      134⤵
                                                                                                                                                                                                                                                                                                        PID:2704
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                          135⤵
                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                          PID:6012
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB944.bat
                                                                                                                                                                                                                                                                                                            136⤵
                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                            PID:5632
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                              137⤵
                                                                                                                                                                                                                                                                                                                PID:1700
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA1F.bat
                                                                                                                                                                                                                                                                                                                  138⤵
                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                  PID:4596
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                    139⤵
                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                    PID:1200
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB57.bat
                                                                                                                                                                                                                                                                                                                      140⤵
                                                                                                                                                                                                                                                                                                                        PID:5960
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                          141⤵
                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                          PID:4868
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC22.bat
                                                                                                                                                                                                                                                                                                                            142⤵
                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                            PID:3404
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                              143⤵
                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                              PID:5112
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBCED.bat
                                                                                                                                                                                                                                                                                                                                144⤵
                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                PID:4744
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                  145⤵
                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                  PID:2548
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBDC8.bat
                                                                                                                                                                                                                                                                                                                                    146⤵
                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                    PID:1440
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                      147⤵
                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                      PID:1492
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBEA3.bat
                                                                                                                                                                                                                                                                                                                                        148⤵
                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                        PID:3556
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                          149⤵
                                                                                                                                                                                                                                                                                                                                            PID:3740
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF8D.bat
                                                                                                                                                                                                                                                                                                                                              150⤵
                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                              PID:1744
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                151⤵
                                                                                                                                                                                                                                                                                                                                                  PID:1144
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC068.bat
                                                                                                                                                                                                                                                                                                                                                    152⤵
                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                    PID:5028
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                      153⤵
                                                                                                                                                                                                                                                                                                                                                        PID:2284
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC133.bat
                                                                                                                                                                                                                                                                                                                                                          154⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                          PID:2424
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                            155⤵
                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                            PID:1504
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC22D.bat
                                                                                                                                                                                                                                                                                                                                                              156⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                              PID:5040
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                157⤵
                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                PID:5480
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC2C9.bat
                                                                                                                                                                                                                                                                                                                                                                  158⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:4276
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                      159⤵
                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                      PID:1104
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC394.bat
                                                                                                                                                                                                                                                                                                                                                                        160⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:4320
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                            161⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:2640
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC48E.bat
                                                                                                                                                                                                                                                                                                                                                                                162⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:2808
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                    163⤵
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    PID:3000
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC55A.bat
                                                                                                                                                                                                                                                                                                                                                                                      164⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:2676
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                          165⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                          PID:2436
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC673.bat
                                                                                                                                                                                                                                                                                                                                                                                            166⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:4412
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                167⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                PID:5520
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC72E.bat
                                                                                                                                                                                                                                                                                                                                                                                                  168⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                  PID:3396
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    169⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4424
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC828.bat
                                                                                                                                                                                                                                                                                                                                                                                                      170⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1844
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        171⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2692
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC8F3.bat
                                                                                                                                                                                                                                                                                                                                                                                                          172⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4296
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            173⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:460
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC9ED.bat
                                                                                                                                                                                                                                                                                                                                                                                                                174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2168
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2352
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCAD8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                      176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4164
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2160
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB84.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3040
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1864
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC6E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3428
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5760
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD39.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                        182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3332
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5488
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE33.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1396
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4108
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCECF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                      186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5356
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4288
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF9B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                            188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5012
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2508
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD037.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD102.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD1AE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD279.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD373.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD42E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD4EA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD596.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD632.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD6CE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD76B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD807.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD8D2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD96E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA0A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDAA7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDB72.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC1E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDCF8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDDA4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE7F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF1B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDFC7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE092.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE14E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE229.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE2E4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE3BF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE48A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE526.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE601.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE69D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE759.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE824.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE90E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE9BA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA66.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB12.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEBED.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEC79.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED35.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEDF0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEEAC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF58.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:952
                                                                                                                                              • C:\Windows\Logo1_.exe
                                                                                                                                                C:\Windows\Logo1_.exe
                                                                                                                                                2⤵
                                                                                                                                                • Creates a file in the Startup directory
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Enumerates connected drives
                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                PID:1100
                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                  net stop "Kingsoft AntiVirus Service"
                                                                                                                                                  3⤵
                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                  PID:6100
                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                    4⤵
                                                                                                                                                      PID:804

                                                                                                                                              Network

                                                                                                                                                    MITRE ATT&CK Enterprise v16

                                                                                                                                                    Reconnaissance

                                                                                                                                                    Resource Development

                                                                                                                                                    Initial Access

                                                                                                                                                    Execution

                                                                                                                                                    Command and Scripting Interpreter

                                                                                                                                                    1
                                                                                                                                                    T1059

                                                                                                                                                    Windows Command Shell

                                                                                                                                                    1
                                                                                                                                                    T1059.003

                                                                                                                                                    Persistence

                                                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                                                    1
                                                                                                                                                    T1547

                                                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                                                    1
                                                                                                                                                    T1547.001

                                                                                                                                                    Privilege Escalation

                                                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                                                    1
                                                                                                                                                    T1547

                                                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                                                    1
                                                                                                                                                    T1547.001

                                                                                                                                                    Defense Evasion

                                                                                                                                                    Credential Access

                                                                                                                                                    Credentials from Password Stores

                                                                                                                                                    1
                                                                                                                                                    T1555

                                                                                                                                                    Credentials from Web Browsers

                                                                                                                                                    1
                                                                                                                                                    T1555.003

                                                                                                                                                    Unsecured Credentials

                                                                                                                                                    1
                                                                                                                                                    T1552

                                                                                                                                                    Credentials In Files

                                                                                                                                                    1
                                                                                                                                                    T1552.001

                                                                                                                                                    Discovery

                                                                                                                                                    Peripheral Device Discovery

                                                                                                                                                    1
                                                                                                                                                    T1120

                                                                                                                                                    Query Registry

                                                                                                                                                    1
                                                                                                                                                    T1012

                                                                                                                                                    System Information Discovery

                                                                                                                                                    1
                                                                                                                                                    T1082

                                                                                                                                                    System Location Discovery

                                                                                                                                                    1
                                                                                                                                                    T1614

                                                                                                                                                    System Language Discovery

                                                                                                                                                    1
                                                                                                                                                    T1614.001

                                                                                                                                                    System Network Configuration Discovery

                                                                                                                                                    1
                                                                                                                                                    T1016

                                                                                                                                                    Lateral Movement

                                                                                                                                                    Collection

                                                                                                                                                    Data from Local System

                                                                                                                                                    1
                                                                                                                                                    T1005

                                                                                                                                                    Command and Control

                                                                                                                                                    Exfiltration

                                                                                                                                                    Impact

                                                                                                                                                    Replay Monitor

                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                    Downloads

                                                                                                                                                    $$a2958.bat
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a2958.bat
                                                                                                                                                    • Size 722B
                                                                                                                                                    • SHA256 f3c6c87808d7126772b7a1eb23581e1c399d8b7730e4ef68ecbe462629007143
                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    $$a2D30.bat
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a2D30.bat
                                                                                                                                                    • Size 722B
                                                                                                                                                    • SHA256 db89c581885430b39417daf5ea3c920ccba9df40acfe2e46891d643432a4f445
                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    $$a3203.bat
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a3203.bat
                                                                                                                                                    • Size 722B
                                                                                                                                                    • SHA256 03b05cc27a075f1637fd3ec15af241c1821bf1fae88804518b94745d3748bdab
                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    $$a3493.bat
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a3493.bat
                                                                                                                                                    • Size 722B
                                                                                                                                                    • SHA256 60da82c947d2ff49c7c7d03c5f9a67cdd58165d494a7e4165e4c9e7cf329045c
                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    $$a3762.bat
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a3762.bat
                                                                                                                                                    • Size 722B
                                                                                                                                                    • SHA256 07bc168624472d40d287d4cb89c8cb8099e0947226a8c0e628cdad53efad6571
                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    $$a3A31.bat
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a3A31.bat
                                                                                                                                                    • Size 722B
                                                                                                                                                    • SHA256 66a73b5aa1183ee9ba2513d5744a6f2e43a14e7f2c21d3e8c4d39146bf346ae9
                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    $$a3CFF.bat
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a3CFF.bat
                                                                                                                                                    • Size 722B
                                                                                                                                                    • SHA256 c5b8667828786ca03e5b7839bcc46411abee4185d3ecbf75332f002b405641f7
                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    $$a4099.bat
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a4099.bat
                                                                                                                                                    • Size 722B
                                                                                                                                                    • SHA256 e9ecfd82c460ce6893b22bac5cad2bdd87e9084cfeb35a9d2cb635dd24924a27
                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    $$a4443.bat
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a4443.bat
                                                                                                                                                    • Size 722B
                                                                                                                                                    • SHA256 1c443073e795789e09bfb94a709082a55568e4394c9de7c18c823f432b94a7b2
                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    $$a4A3E.bat
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a4A3E.bat
                                                                                                                                                    • Size 722B
                                                                                                                                                    • SHA256 a3e7c217f63f2dff640182aca500d06cf6fea0b36effd79369e0600f89480b64
                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    $$a5152.bat
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a5152.bat
                                                                                                                                                    • Size 722B
                                                                                                                                                    • SHA256 e8380f06dc0b7df36a573a4f2ffe5352c80cd491b70fdc241d29c161f4473247
                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    $$a548F.bat
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a548F.bat
                                                                                                                                                    • Size 722B
                                                                                                                                                    • SHA256 581ac9e695844a10b40e7c5afe0ae076d4b9e7992ed30c46e2fe58af271e221a
                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    $$a6B14.bat
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a6B14.bat
                                                                                                                                                    • Size 722B
                                                                                                                                                    • SHA256 60bed58051908d931ad1196983cc7924874c5da1b281772cf7b4b73a5408cbb3
                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    $$a6D76.bat
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a6D76.bat
                                                                                                                                                    • Size 722B
                                                                                                                                                    • SHA256 3bc2736f45a6d2ce806e371f4286a48823daee35c5ecdf815f56eebc16523ac3
                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    $$a7229.bat
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a7229.bat
                                                                                                                                                    • Size 722B
                                                                                                                                                    • SHA256 d425eba6c42e8c52263eaeae3fe6817f65c274c87493c608660d98539eba4608
                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    $$a74B9.bat
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a74B9.bat
                                                                                                                                                    • Size 722B
                                                                                                                                                    • SHA256 72846bd33cd4cdd11814121a2851bf3f433790d00d1f7bfee9986a227b0272e6
                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    $$a773A.bat
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a773A.bat
                                                                                                                                                    • Size 722B
                                                                                                                                                    • SHA256 26abe929e7686accfa2f4af8db68f0af382593bc4e5a651d1c3be91f46da73d8
                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    $$a83AD.bat
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a83AD.bat
                                                                                                                                                    • Size 722B
                                                                                                                                                    • SHA256 74119d2cfc445a5483eca37a38ddfaf483224be953869408df05fadb48f128b9
                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    $$a85B1.bat
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a85B1.bat
                                                                                                                                                    • Size 722B
                                                                                                                                                    • SHA256 2308b1252d6b0fdb9187d455c9c9627da55e3a1d04a786599e246102655a3dc9
                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    $$a8851.bat
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a8851.bat
                                                                                                                                                    • Size 722B
                                                                                                                                                    • SHA256 872d0d839776422f351612222492688e7346c964f5680cd41c2a5654b560bb2c
                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    $$a8AE1.bat
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a8AE1.bat
                                                                                                                                                    • Size 722B
                                                                                                                                                    • SHA256 67ba6563bc01c61f1b790d867184fe979e45cb9d5e66e99a7fe4ede08b3d62f3
                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe.exe
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe.exe
                                                                                                                                                    • Size 4.4MB
                                                                                                                                                    • SHA256 f566ca842e4e2245f5fb32877fa57f7479c665a16a316fe42909cfee3e81a965
                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe.exe
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe.exe
                                                                                                                                                    • Size 4.3MB
                                                                                                                                                    • SHA256 c6c4d42d88d4114c6b08e6ba8448e3ec5e97deb6079d86b800da6a9ef28c1df1
                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe.exe
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe.exe
                                                                                                                                                    • Size 4.2MB
                                                                                                                                                    • SHA256 6e25caa1edf9f96188f7568bad2ff553c61c96a32118cffbadd9c1adfba21eb3
                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe.exe
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe.exe
                                                                                                                                                    • Size 4.3MB
                                                                                                                                                    • SHA256 2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390
                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe.exe
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe.exe
                                                                                                                                                    • Size 4.2MB
                                                                                                                                                    • SHA256 e65e13b8d7b652ca5cbb7c6c3a72160d210bff551e7ea8738f183958bbeea027
                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe.exe
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe.exe
                                                                                                                                                    • Size 4.2MB
                                                                                                                                                    • SHA256 43ffcaab19ec2eac66a4915d8d442449749bc1ea0e68ca0c519abb0255e607f5
                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe.exe
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe.exe
                                                                                                                                                    • Size 4.4MB
                                                                                                                                                    • SHA256 c6702668586199a38f28a65abf7a2c6ac52af60f5fe1053cd04d4be05f9a0fe0
                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe.exe
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe.exe
                                                                                                                                                    • Size 4.4MB
                                                                                                                                                    • SHA256 314e0cb23c197b3b5b9daaedcf7ea4cdaf0fc672754bcabb07a6453d9019d7f5
                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe.exe
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe.exe
                                                                                                                                                    • Size 4.5MB
                                                                                                                                                    • SHA256 def1879b1c08182f0f4ecea4fcbfb4d6979c9d21f05933f9a91005327706c118
                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe.exe
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe.exe
                                                                                                                                                    • Size 4.3MB
                                                                                                                                                    • SHA256 63c0fafdeac9a636fa9b0cfc9d54f331fba20d2450b3d633cf17ba45b9ef791d
                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe.exe
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe.exe
                                                                                                                                                    • Size 4.6MB
                                                                                                                                                    • SHA256 d724858e937e7d6dbd5aa6be64d3b6f401230e41b6ea6e8d0a3933ea50798ac9
                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe.exe
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe.exe
                                                                                                                                                    • Size 4.5MB
                                                                                                                                                    • SHA256 f09e4f1427d4ac39e07fa77fd25abc4cfdcbfb9db3bc5bdebc29ef366c73add5
                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe.exe
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe.exe
                                                                                                                                                    • Size 4.7MB
                                                                                                                                                    • SHA256 463e77a73f4c83d7800734a7d4cbf50557b24fc8a6d15ccc0d6f0386fc97de29
                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe.exe
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe.exe
                                                                                                                                                    • Size 4.5MB
                                                                                                                                                    • SHA256 eec636e78e4f38e30f62d20aab955a24210fcef6eb1b5de23ec24425b018ef48
                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe.exe
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe.exe
                                                                                                                                                    • Size 4.8MB
                                                                                                                                                    • SHA256 84b4ca6b8ab7e2df8399ca3aad59ed43054b99622bdde2eeb0f05c6edf9de2c0
                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe.exe
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe.exe
                                                                                                                                                    • Size 4.7MB
                                                                                                                                                    • SHA256 7653c92ff5d7e05d9953c65824a7512bc78987315db4a18fc6a5a7a53ad8f2c0
                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe.exe
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe.exe
                                                                                                                                                    • Size 4.7MB
                                                                                                                                                    • SHA256 dc61fa82f3fa5d66472e57958ac1ef7e95754ae19eeee9af31aec045f2546f93
                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe.exe
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe.exe
                                                                                                                                                    • Size 4.6MB
                                                                                                                                                    • SHA256 c5c0b563c112a4495b34db48f123913487950eb0dfea3ff82bfe90368272901c
                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe.exe
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe.exe
                                                                                                                                                    • Size 4.8MB
                                                                                                                                                    • SHA256 c0a58dfe8a905dbf4e2eef91967cfa830c35496474b7f0e9f04127abcb82fef8
                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe.exe
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\6e420c653575d626fdde1c8aacc1c58c98c383fcd9a6c2ea98e60512397f0f7a.exe.exe
                                                                                                                                                    • Size 4.6MB
                                                                                                                                                    • SHA256 58108e2d387614ed922db13991b47898b5129d1ec96f80903fd3f89b605e4c13
                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    Logo1_.exe
                                                                                                                                                    • Path C:\Windows\Logo1_.exe
                                                                                                                                                    • Size 32KB
                                                                                                                                                    • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    _desktop.ini
                                                                                                                                                    • Path F:\$RECYCLE.BIN\_desktop.ini
                                                                                                                                                    • Size 9B
                                                                                                                                                    • SHA256 66c5371c302c0168792bdad2070b6db71275df5a2ac194c19d038c7fdde2b7d6
                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                    Submit Download

                                                                                                                                                    memory/200-8799-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/260-8257-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/460-8680-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/476-8330-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/480-5607-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/696-8855-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/988-8778-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/996-8960-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/1060-8820-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/1100-499-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/1100-1871-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/1100-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/1100-8368-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/1100-6507-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/1104-8630-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/1144-8602-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/1200-8560-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/1264-24-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/1308-8276-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/1324-8373-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/1348-8475-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/1492-8588-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/1496-8487-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/1504-8616-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/1508-9033-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/1508-9039-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/1512-8481-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/1560-1930-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/1660-8366-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/1700-8553-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/1724-8995-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/1740-6077-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/1756-9024-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/1864-8701-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/1880-8518-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/1944-8469-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/1972-64-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/1988-8294-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/2044-8743-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/2160-8694-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/2220-8981-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/2284-8609-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/2320-8445-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/2336-8848-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/2352-8687-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/2412-8385-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/2436-8652-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/2484-8939-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/2492-9031-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/2508-8736-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/2548-8581-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/2584-8270-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/2640-8637-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/2660-8415-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/2692-8673-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/2728-8397-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/2744-8876-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/2788-9002-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/2844-8354-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/2852-8336-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/2884-8342-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/2888-8324-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/2904-73-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/2916-8925-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/2920-8312-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/2972-8946-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/3000-8644-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/3048-8505-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/3252-8499-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/3260-1024-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/3276-8883-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/3316-8451-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/3352-8813-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/3392-9017-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/3400-8360-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/3420-8988-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/3544-8897-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/3632-84-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/3636-8318-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/3648-8306-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/3692-8827-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/3696-51-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/3736-8841-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/3740-8595-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/3768-8904-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/3788-8264-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/3904-8282-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/3912-8403-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4092-8932-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4100-8439-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4108-8722-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4112-36-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4116-8237-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4180-8427-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4204-9009-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4212-8348-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4288-8729-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4372-8248-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4376-8869-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4424-8666-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4476-8953-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4524-8421-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4620-13-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4620-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4636-8511-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4700-5598-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4708-8806-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4716-8288-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4772-8539-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4776-8750-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4820-8974-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4836-6099-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4868-8567-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4884-328-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4896-8463-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4948-8757-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4980-8532-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4992-8493-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5096-8300-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5104-8391-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5112-8574-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5148-8890-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5340-8967-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5408-8457-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5476-8228-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5480-8623-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5488-8715-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5504-8862-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5508-6086-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5520-8659-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5528-8785-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5552-8433-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5592-8764-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5616-8792-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5624-8911-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5760-8708-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5828-119-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5836-8834-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5868-8918-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5912-8771-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5940-8525-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5984-8409-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/6012-8546-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/6104-8379-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/6112-1877-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download