Overview

overview

7

Static

static

3

ed34ceddba...97.exe

windows10-2004-x64

7

ed34ceddba...97.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    11/10/2026, 09:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
  • Size 5.0MB
  • Sample261011-k5pcssfb38
  • SHA256 ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
    "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:812
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC937.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:740
      • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
        "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4380
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB2B.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1236
          • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
            "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2932
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCED4.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:4236
              • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:1536
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD210.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4756
                  • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                    "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:2916
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD52D.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1672
                      • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                        "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of WriteProcessMemory
                        PID:2440
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA4E.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4716
                          • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                            "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                            13⤵
                            • Executes dropped EXE
                            PID:4348
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE74.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:2364
                              • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                15⤵
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:3104
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE2E9.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:4760
                                  • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                    "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:4416
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE5D7.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:2484
                                      • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                        "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:4036
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE7DA.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:5072
                                          • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                            "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:4640
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF0E.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • Suspicious use of WriteProcessMemory
                                              PID:2412
                                              • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of WriteProcessMemory
                                                PID:2572
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF373.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4176
                                                  • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:512
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF6DE.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4740
                                                      • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:3468
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFB24.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:1152
                                                          • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:5000
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE1.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:5112
                                                              • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:4404
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4D8.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:240
                                                                  • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:5616
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D0.bat
                                                                      34⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:5644
                                                                      • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:5724
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBAE.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:5752
                                                                          • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:5904
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE00.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:5932
                                                                              • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:5880
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a113C.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:5920
                                                                                  • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:5372
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a14E6.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:5388
                                                                                      • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:960
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1B10.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:2148
                                                                                          • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:5772
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1EF8.bat
                                                                                              46⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4424
                                                                                              • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4896
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2169.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:6092
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:5344
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a22B1.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:5364
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:5460
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a233E.bat
                                                                                                          52⤵
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:5472
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:5492
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2457.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:5544
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:3112
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2532.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:5620
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:5660
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a25DD.bat
                                                                                                                      58⤵
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:5600
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:5608
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a26C8.bat
                                                                                                                          60⤵
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:5768
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:5668
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a284E.bat
                                                                                                                              62⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                              PID:5812
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:5864
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a29B6.bat
                                                                                                                                  64⤵
                                                                                                                                    PID:5908
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      PID:6040
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2AA0.bat
                                                                                                                                        66⤵
                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:6100
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                          67⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          PID:6124
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B4C.bat
                                                                                                                                            68⤵
                                                                                                                                              PID:3140
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                69⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:372
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2BB9.bat
                                                                                                                                                  70⤵
                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                  PID:4156
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                    71⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:2304
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2C36.bat
                                                                                                                                                      72⤵
                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                      PID:2960
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                        73⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                        PID:3364
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D21.bat
                                                                                                                                                          74⤵
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:5052
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                            75⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            PID:4704
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2DBD.bat
                                                                                                                                                              76⤵
                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:1380
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                77⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:3696
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E4A.bat
                                                                                                                                                                  78⤵
                                                                                                                                                                    PID:1676
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                      79⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      PID:4488
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F34.bat
                                                                                                                                                                        80⤵
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:760
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                          81⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:5108
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2FD0.bat
                                                                                                                                                                            82⤵
                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                            PID:4828
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                              83⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              PID:5784
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a309B.bat
                                                                                                                                                                                84⤵
                                                                                                                                                                                  PID:4812
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                    85⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                    PID:1688
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3167.bat
                                                                                                                                                                                      86⤵
                                                                                                                                                                                        PID:4664
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                          87⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          PID:4948
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3212.bat
                                                                                                                                                                                            88⤵
                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                            PID:3272
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                              89⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              PID:2404
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3280.bat
                                                                                                                                                                                                90⤵
                                                                                                                                                                                                  PID:944
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                    91⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:1076
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a331C.bat
                                                                                                                                                                                                      92⤵
                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                      PID:3188
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                        93⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                        PID:4460
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a33A9.bat
                                                                                                                                                                                                          94⤵
                                                                                                                                                                                                            PID:5984
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                              95⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:5280
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3455.bat
                                                                                                                                                                                                                96⤵
                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                PID:392
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                  97⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  PID:5132
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a34F1.bat
                                                                                                                                                                                                                    98⤵
                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                    PID:5196
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                      99⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:5312
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a356E.bat
                                                                                                                                                                                                                        100⤵
                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                        PID:5044
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                          101⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:3160
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a35DB.bat
                                                                                                                                                                                                                            102⤵
                                                                                                                                                                                                                              PID:1904
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                103⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                PID:5452
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3677.bat
                                                                                                                                                                                                                                  104⤵
                                                                                                                                                                                                                                    PID:5540
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                      105⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                      PID:5496
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3704.bat
                                                                                                                                                                                                                                        106⤵
                                                                                                                                                                                                                                          PID:4672
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                            107⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:5548
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3781.bat
                                                                                                                                                                                                                                              108⤵
                                                                                                                                                                                                                                                PID:5628
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                  109⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  PID:5712
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a380E.bat
                                                                                                                                                                                                                                                    110⤵
                                                                                                                                                                                                                                                      PID:5760
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                        111⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                        PID:5732
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a38AA.bat
                                                                                                                                                                                                                                                          112⤵
                                                                                                                                                                                                                                                            PID:5648
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                              113⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              PID:5900
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3927.bat
                                                                                                                                                                                                                                                                114⤵
                                                                                                                                                                                                                                                                  PID:6032
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                    115⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                    PID:6056
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a39C3.bat
                                                                                                                                                                                                                                                                      116⤵
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:6044
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                        117⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        PID:2848
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3A40.bat
                                                                                                                                                                                                                                                                          118⤵
                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          PID:6068
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                            119⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            PID:3080
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3AFC.bat
                                                                                                                                                                                                                                                                              120⤵
                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                              PID:1184
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                121⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                PID:4888
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3B88.bat
                                                                                                                                                                                                                                                                                  122⤵
                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                  PID:3044
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                    123⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    PID:5968
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3C34.bat
                                                                                                                                                                                                                                                                                      124⤵
                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                      PID:5956
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                        125⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                        PID:1156
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3CFF.bat
                                                                                                                                                                                                                                                                                          126⤵
                                                                                                                                                                                                                                                                                            PID:2492
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                              127⤵
                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                              PID:3088
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3D9C.bat
                                                                                                                                                                                                                                                                                                128⤵
                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                PID:5004
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                  129⤵
                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                  PID:2604
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3E57.bat
                                                                                                                                                                                                                                                                                                    130⤵
                                                                                                                                                                                                                                                                                                      PID:5008
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                        131⤵
                                                                                                                                                                                                                                                                                                          PID:5096
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3F61.bat
                                                                                                                                                                                                                                                                                                            132⤵
                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                            PID:4900
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                              133⤵
                                                                                                                                                                                                                                                                                                                PID:4304
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3FDE.bat
                                                                                                                                                                                                                                                                                                                  134⤵
                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                  PID:4548
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                    135⤵
                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                    PID:4676
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a402C.bat
                                                                                                                                                                                                                                                                                                                      136⤵
                                                                                                                                                                                                                                                                                                                        PID:4212
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                          137⤵
                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                          PID:4032
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a407A.bat
                                                                                                                                                                                                                                                                                                                            138⤵
                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                            PID:5156
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                              139⤵
                                                                                                                                                                                                                                                                                                                                PID:2416
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a40C8.bat
                                                                                                                                                                                                                                                                                                                                  140⤵
                                                                                                                                                                                                                                                                                                                                    PID:5300
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                      141⤵
                                                                                                                                                                                                                                                                                                                                        PID:5168
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4116.bat
                                                                                                                                                                                                                                                                                                                                          142⤵
                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                          PID:5324
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                            143⤵
                                                                                                                                                                                                                                                                                                                                              PID:2312
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4164.bat
                                                                                                                                                                                                                                                                                                                                                144⤵
                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                PID:5268
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                  145⤵
                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                  PID:5304
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a41B2.bat
                                                                                                                                                                                                                                                                                                                                                    146⤵
                                                                                                                                                                                                                                                                                                                                                      PID:5368
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                        147⤵
                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                        PID:5508
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4201.bat
                                                                                                                                                                                                                                                                                                                                                          148⤵
                                                                                                                                                                                                                                                                                                                                                            PID:5896
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                              149⤵
                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                              PID:5556
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a424F.bat
                                                                                                                                                                                                                                                                                                                                                                150⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:1412
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                    151⤵
                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                    PID:1684
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a42AC.bat
                                                                                                                                                                                                                                                                                                                                                                      152⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                      PID:5612
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                        153⤵
                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                        PID:5672
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a430A.bat
                                                                                                                                                                                                                                                                                                                                                                          154⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                          PID:5700
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                            155⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:5736
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a43E5.bat
                                                                                                                                                                                                                                                                                                                                                                                156⤵
                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                PID:5692
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                  157⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                  PID:5832
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a44A0.bat
                                                                                                                                                                                                                                                                                                                                                                                    158⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                    PID:6104
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                      159⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                      PID:3068
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a452D.bat
                                                                                                                                                                                                                                                                                                                                                                                        160⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:6116
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                            161⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                            PID:3928
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a45AA.bat
                                                                                                                                                                                                                                                                                                                                                                                              162⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                              PID:3704
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                163⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                PID:1692
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4646.bat
                                                                                                                                                                                                                                                                                                                                                                                                  164⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4276
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      165⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                      PID:3024
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a46F2.bat
                                                                                                                                                                                                                                                                                                                                                                                                        166⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4044
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          167⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1112
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a47FC.bat
                                                                                                                                                                                                                                                                                                                                                                                                              168⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1260
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2496
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4905.bat
                                                                                                                                                                                                                                                                                                                                                                                                                  170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2664
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2000
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4992.bat
                                                                                                                                                                                                                                                                                                                                                                                                                        172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5380
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3760
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4A7C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                            174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4328
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6088
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4B28.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2096
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1196
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4BD4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                      178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5260
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5152
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4C51.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                            180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5228
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3656
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4CED.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                  182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5980
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5272
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4D7A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                        184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2668
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5484
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4E26.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4EB3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F20.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4FCC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5049.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a50B6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5152.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a520E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5308.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5402.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a550C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5598.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5634.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a56C1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a574E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a57FA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5867.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5932.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a599F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5A3C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5AD8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5B55.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5BF1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5CBC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5D39.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5DC6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5EA1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5F3D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5FBA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6037.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6095.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a60F2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6160.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a61CD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a62A8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6344.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a64AC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a65E4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6661.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a66CE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a673C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a67A9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6826.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a68D2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a693F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a69BC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6A2A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6AB6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B33.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6BC0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2760
                                                                                                                                                              • C:\Windows\Logo1_.exe
                                                                                                                                                                C:\Windows\Logo1_.exe
                                                                                                                                                                2⤵
                                                                                                                                                                • Creates a file in the Startup directory
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                PID:2752
                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                  net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                  PID:3980
                                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                    4⤵
                                                                                                                                                                      PID:4740

                                                                                                                                                              Network

                                                                                                                                                                    MITRE ATT&CK Enterprise v16

                                                                                                                                                                    Reconnaissance

                                                                                                                                                                    Resource Development

                                                                                                                                                                    Initial Access

                                                                                                                                                                    Execution

                                                                                                                                                                    Command and Scripting Interpreter

                                                                                                                                                                    1
                                                                                                                                                                    T1059

                                                                                                                                                                    Windows Command Shell

                                                                                                                                                                    1
                                                                                                                                                                    T1059.003

                                                                                                                                                                    Persistence

                                                                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                                                                    1
                                                                                                                                                                    T1547

                                                                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                                                                    1
                                                                                                                                                                    T1547.001

                                                                                                                                                                    Privilege Escalation

                                                                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                                                                    1
                                                                                                                                                                    T1547

                                                                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                                                                    1
                                                                                                                                                                    T1547.001

                                                                                                                                                                    Defense Evasion

                                                                                                                                                                    Credential Access

                                                                                                                                                                    Credentials from Password Stores

                                                                                                                                                                    1
                                                                                                                                                                    T1555

                                                                                                                                                                    Credentials from Web Browsers

                                                                                                                                                                    1
                                                                                                                                                                    T1555.003

                                                                                                                                                                    Unsecured Credentials

                                                                                                                                                                    1
                                                                                                                                                                    T1552

                                                                                                                                                                    Credentials In Files

                                                                                                                                                                    1
                                                                                                                                                                    T1552.001

                                                                                                                                                                    Discovery

                                                                                                                                                                    Peripheral Device Discovery

                                                                                                                                                                    1
                                                                                                                                                                    T1120

                                                                                                                                                                    Query Registry

                                                                                                                                                                    1
                                                                                                                                                                    T1012

                                                                                                                                                                    System Information Discovery

                                                                                                                                                                    1
                                                                                                                                                                    T1082

                                                                                                                                                                    System Location Discovery

                                                                                                                                                                    1
                                                                                                                                                                    T1614

                                                                                                                                                                    System Language Discovery

                                                                                                                                                                    1
                                                                                                                                                                    T1614.001

                                                                                                                                                                    System Network Configuration Discovery

                                                                                                                                                                    1
                                                                                                                                                                    T1016

                                                                                                                                                                    Lateral Movement

                                                                                                                                                                    Collection

                                                                                                                                                                    Data from Local System

                                                                                                                                                                    1
                                                                                                                                                                    T1005

                                                                                                                                                                    Command and Control

                                                                                                                                                                    Exfiltration

                                                                                                                                                                    Impact

                                                                                                                                                                    Replay Monitor

                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                    Downloads

                                                                                                                                                                    $$a113C.bat
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a113C.bat
                                                                                                                                                                    • Size 722B
                                                                                                                                                                    • SHA256 b1a8b6d27da0170fd78b40322c01061a70e1f85ee56e8262e7cb5646fb7c97a4
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    $$a14E6.bat
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a14E6.bat
                                                                                                                                                                    • Size 722B
                                                                                                                                                                    • SHA256 65d683c7d18355213391f96a20c01122cde5ed0f110899de38b85b16c14e7f92
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    $$a1B10.bat
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a1B10.bat
                                                                                                                                                                    • Size 722B
                                                                                                                                                                    • SHA256 4b3f39a37ba4897f63366c41d203403e21061b2c7684207296f5a51a584cff19
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    $$a4D8.bat
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a4D8.bat
                                                                                                                                                                    • Size 721B
                                                                                                                                                                    • SHA256 3f0145dcdf0c437397fc4459ffde3ca61caec5df2a48805eb0802f0533caf20e
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    $$a8D0.bat
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a8D0.bat
                                                                                                                                                                    • Size 721B
                                                                                                                                                                    • SHA256 dcf31dd11b71d1e84c64cf27e7cedf7384da5398133f4f6ca47e0a81aaba22c7
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    $$aBAE.bat
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aBAE.bat
                                                                                                                                                                    • Size 721B
                                                                                                                                                                    • SHA256 b5bf9ce129d10c31e7875d9010d5452b5c1dfaade385b84eb3d30f8ca71d0417
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    $$aC937.bat
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aC937.bat
                                                                                                                                                                    • Size 722B
                                                                                                                                                                    • SHA256 0d03713b7da823164f3c4bdd4dc39e7397c0114d79f2eda91f3dbc93c45e16da
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    $$aCB2B.bat
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aCB2B.bat
                                                                                                                                                                    • Size 722B
                                                                                                                                                                    • SHA256 32c33fb7c00f5426102c1640c0fd9772d4dcf3f5b96b6be34ef58d9354753d0b
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    $$aCED4.bat
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aCED4.bat
                                                                                                                                                                    • Size 722B
                                                                                                                                                                    • SHA256 fddd6e86d63f1e83435b15f38a01ba7d15258aac17d7307a14d5d7f3bde23296
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    $$aD210.bat
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aD210.bat
                                                                                                                                                                    • Size 722B
                                                                                                                                                                    • SHA256 004fb929d33fa366c5287f83dd49e52a318eeb2d92b15677d9f34012f628f32b
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    $$aD52D.bat
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aD52D.bat
                                                                                                                                                                    • Size 722B
                                                                                                                                                                    • SHA256 e2e8ea64f56e89372127e931999565877f41c12fc0f785342b9acf8e9f743794
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    $$aDA4E.bat
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aDA4E.bat
                                                                                                                                                                    • Size 722B
                                                                                                                                                                    • SHA256 733dc175421a145b1f345c20473c7dbf482866ce5f8ce3b0abec85ca4fbe728b
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    $$aE00.bat
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aE00.bat
                                                                                                                                                                    • Size 721B
                                                                                                                                                                    • SHA256 aedef4129ff3f97fbc96525478f2c0b1e3ed57fa1ca1a93d35ecb31e9775db6a
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    $$aE1.bat
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aE1.bat
                                                                                                                                                                    • Size 720B
                                                                                                                                                                    • SHA256 86e43b80649aeddcfcbf9bbb605fc8e135930ee2bf9196764cb8f71fe6047905
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    $$aE2E9.bat
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aE2E9.bat
                                                                                                                                                                    • Size 722B
                                                                                                                                                                    • SHA256 1d041f7d0fc1ec5cc4adfb127223a3f01c8609bf6c23ab47ced0aff64ec76f9a
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    $$aE5D7.bat
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aE5D7.bat
                                                                                                                                                                    • Size 722B
                                                                                                                                                                    • SHA256 683c6e67429fb34580c05449ddd2bd91ec8de0b10188796d52fcf1dca9e4e97d
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    $$aE7DA.bat
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aE7DA.bat
                                                                                                                                                                    • Size 722B
                                                                                                                                                                    • SHA256 cbb70f7d84bd09b45c07d99429c922256ccc73b4bfb70c2cebd31285ea8a9190
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    $$aEF0E.bat
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aEF0E.bat
                                                                                                                                                                    • Size 722B
                                                                                                                                                                    • SHA256 a28bbd8e6152dcb419f1febfcd3b9706abb70aaf83872f0110779211f57f67be
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    $$aF373.bat
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aF373.bat
                                                                                                                                                                    • Size 722B
                                                                                                                                                                    • SHA256 de23ad77bbaedf2e94978d137abd95baebb8b2e8bc860ee3cfe67837d0439806
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    $$aF6DE.bat
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aF6DE.bat
                                                                                                                                                                    • Size 722B
                                                                                                                                                                    • SHA256 aac48fd996d3dc0aaf1cefaf000be87c2aee12bc3ffdb037a286ea2124024db9
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    $$aFB24.bat
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aFB24.bat
                                                                                                                                                                    • Size 722B
                                                                                                                                                                    • SHA256 2956ca7e17f7f10088594296ae753265c6a8e06315fbb7739b72556812fc91a4
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe
                                                                                                                                                                    • Size 4.4MB
                                                                                                                                                                    • SHA256 637be70a1eb4e987d0eb8cbd2661bf2dcd35417cdf833f33ba69a87b2dd947ec
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe.exe
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe.exe
                                                                                                                                                                    • Size 4.9MB
                                                                                                                                                                    • SHA256 938ce2721fd19429546e693e59ec214de2b09a90069e6db12144d9b3683c2c89
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe.exe
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe.exe
                                                                                                                                                                    • Size 4.7MB
                                                                                                                                                                    • SHA256 5149dd97de5369819476da2f31a380fad116b79a3048842923c17d5423c37052
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe.exe
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe.exe
                                                                                                                                                                    • Size 4.6MB
                                                                                                                                                                    • SHA256 7dbcf1599a26b0e3bf8f681112a223475441a13852889b12314323dc683167ae
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe.exe
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe.exe
                                                                                                                                                                    • Size 4.6MB
                                                                                                                                                                    • SHA256 37fc6b69a8363e8a00963fffebc413bdf5246d2c29cb0dd7a5a88e92167d64d6
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe.exe
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe.exe
                                                                                                                                                                    • Size 4.5MB
                                                                                                                                                                    • SHA256 86796fbde95eac7f8a7477d8573af64df685c2ac30b836cf676728d4c9da06b5
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe.exe
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe.exe
                                                                                                                                                                    • Size 4.5MB
                                                                                                                                                                    • SHA256 e099f0a2a6e75ad97bf2049ed620b30a15e9abbc5931c3b716ae157d329438bd
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe.exe
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe.exe
                                                                                                                                                                    • Size 4.5MB
                                                                                                                                                                    • SHA256 ab12ce441668863066ea31fac987775279148e699dfb5f2c0a585285f6c58faf
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe.exe
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe.exe
                                                                                                                                                                    • Size 4.3MB
                                                                                                                                                                    • SHA256 30aa8665269ecba98b7cd73f10c09dbb682575341cf35b102ecb4a2e22f407b9
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe.exe
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe.exe
                                                                                                                                                                    • Size 4.3MB
                                                                                                                                                                    • SHA256 966cfcd1c532de9cde11625cea430f88dcc2d001c0a715c513daa238f37a95d6
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe.exe
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe.exe
                                                                                                                                                                    • Size 4.3MB
                                                                                                                                                                    • SHA256 37398e5b99de643200ca44805382d5fe5b892e69aaafec7f0151aa94c5e23531
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe.exe
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe.exe
                                                                                                                                                                    • Size 4.8MB
                                                                                                                                                                    • SHA256 5f22a618db3ea72f192497318d5bd18d87e022195a2b6faea13b466d1beea823
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe.exe
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe.exe
                                                                                                                                                                    • Size 4.7MB
                                                                                                                                                                    • SHA256 81e53d01ada951cb912c45ce47b210160e38ca3d0ba9e74f7e385012d5f69991
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe.exe
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe.exe
                                                                                                                                                                    • Size 4.6MB
                                                                                                                                                                    • SHA256 01c7671e0d27653cbe33536bc6bab94cce58adb08b09d7cd618185a716847e42
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe.exe
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe.exe
                                                                                                                                                                    • Size 4.4MB
                                                                                                                                                                    • SHA256 6db3ff413b5f271d322cbffc865a658253328b91c71255d64c9a86a80c46a509
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe.exe
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe.exe
                                                                                                                                                                    • Size 4.4MB
                                                                                                                                                                    • SHA256 913b4abcf82246e7a7f57604c0fde4495fcb7c662a9a41c108143c728b65c2f9
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe.exe
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe.exe
                                                                                                                                                                    • Size 4.9MB
                                                                                                                                                                    • SHA256 c8b7f0ac62305c580b81727b7cd204a873f8b2edd163e319a54c2307f8dde00a
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe.exe
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe.exe
                                                                                                                                                                    • Size 4.8MB
                                                                                                                                                                    • SHA256 4c7445fbfee5436e8e6f94d41586634bbd1a4db0a4743003ba36c97de14e207e
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe.exe
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe.exe
                                                                                                                                                                    • Size 4.8MB
                                                                                                                                                                    • SHA256 5bdf2eba90789218568d0d2701f45a188fe00f86337e721ced99e8ace6a0fff4
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe.exe
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ed34ceddba770758c4d5e05a7ec85503b695c242792352484b18be1149e11d97.exe.exe
                                                                                                                                                                    • Size 4.9MB
                                                                                                                                                                    • SHA256 0f8ba87ccd240d147d5fbe1e33894b28cd34d67d48c96ac8d04fdccf6834bd60
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    Logo1_.exe
                                                                                                                                                                    • Path C:\Windows\Logo1_.exe
                                                                                                                                                                    • Size 32KB
                                                                                                                                                                    • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    _desktop.ini
                                                                                                                                                                    • Path F:\$RECYCLE.BIN\_desktop.ini
                                                                                                                                                                    • Size 10B
                                                                                                                                                                    • SHA256 6f32c14d8a0712d435829019df23525a5b62bb2ca9b24874a6316ec374b3d04c
                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                    Submit Download

                                                                                                                                                                    memory/372-10128-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/512-3908-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/812-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/812-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/872-10672-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/960-8481-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/1016-10569-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/1040-10647-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/1076-10183-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/1112-10395-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/1156-10268-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/1196-10425-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/1460-10617-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/1532-10653-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/1536-46-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/1684-10347-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/1688-10168-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/1692-10383-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/1720-10738-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/1896-10702-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/1900-10641-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/2000-10407-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/2160-10503-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/2304-10133-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/2312-10323-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/2404-10178-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/2416-10311-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/2440-68-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/2496-10401-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/2572-3332-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/2588-10533-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/2604-10280-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/2752-8396-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/2752-1098-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/2752-3247-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/2752-8-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/2768-10690-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/2788-10593-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/2848-10248-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/2916-54-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/2932-31-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/2948-10485-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/3024-10389-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/3032-10599-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/3068-10371-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/3080-10253-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/3088-10274-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/3104-1232-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/3112-10093-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/3160-10208-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/3172-10605-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/3308-10696-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/3364-10138-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/3468-4837-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/3656-10437-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/3696-10148-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/3760-10413-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/3804-10611-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/3888-10587-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/3928-10377-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/4000-10527-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/4032-10305-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/4036-1849-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/4036-1853-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/4124-10515-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/4224-10509-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/4304-10293-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/4340-10497-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/4348-210-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/4348-181-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/4380-21-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/4388-10623-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/4392-10545-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/4404-5605-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/4416-1844-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/4460-10188-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/4488-10153-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/4560-10539-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/4640-2317-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/4676-10299-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/4680-10684-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/4704-10143-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/4888-10258-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/4896-10016-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/4948-10173-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/4976-10521-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/4992-10491-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5000-5591-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5096-10287-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5108-10158-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5124-10708-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5132-10198-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5152-10431-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5168-10317-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5200-10629-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5204-10557-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5208-10726-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5272-10443-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5280-10193-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5304-10329-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5312-10203-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5336-10714-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5340-10635-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5344-10078-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5360-10551-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5372-7546-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5384-10563-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5440-10720-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5452-10213-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5460-10083-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5484-10449-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5492-10088-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5496-10218-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5508-10335-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5548-10223-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5556-10341-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5576-10455-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5584-10732-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5592-10461-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5608-10103-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5616-6110-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5660-10098-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5664-10575-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5668-10108-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5672-10353-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5676-10467-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5712-10228-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5724-6122-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5732-10233-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5736-10359-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5744-10659-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5772-9307-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5784-10163-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5832-10365-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5844-10479-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5856-10473-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5864-10113-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5880-6658-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5900-10238-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5904-6152-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5924-10740-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5924-10745-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5964-10678-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5968-10263-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/6040-10118-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/6056-10243-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/6060-10665-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/6072-10581-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/6088-10419-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/6124-10123-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                    Download