Overview

overview

7

Static

static

3

3739990b03...a3.exe

windows10-2004-x64

7

3739990b03...a3.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/10/2026, 09:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
  • Size 5.9MB
  • Sample261011-lcvjsafc77
  • SHA256 3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
    "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4924
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1A16.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5068
      • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
        "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:4716
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1BCB.bat
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1732
          • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
            "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4508
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a20AD.bat
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2608
              • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:3404
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2495.bat
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:1216
                  • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                    "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:264
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2939.bat
                      10⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:4580
                      • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                        "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:5712
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2DEC.bat
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:5296
                          • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                            "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:1804
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3714.bat
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:3880
                              • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:3952
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3C44.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:2724
                                  • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                    "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:2856
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4E36.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:5316
                                      • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                        "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:1412
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5431.bat
                                          20⤵
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:5684
                                          • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                            "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:5332
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a56F0.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • Suspicious use of WriteProcessMemory
                                              PID:4128
                                              • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:4608
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5C7E.bat
                                                  24⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:2908
                                                  • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:5428
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6623.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2292
                                                      • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2076
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6AA7.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:5976
                                                          • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:4772
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6EAE.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:5476
                                                              • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:3412
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7390.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:2452
                                                                  • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:2640
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7778.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:4868
                                                                      • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:3816
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7BDD.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:1464
                                                                          • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:3032
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a80A0.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:5544
                                                                              • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:4632
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8563.bat
                                                                                  40⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:3100
                                                                                  • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:4908
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A16.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4636
                                                                                      • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:5240
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8EB9.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:1512
                                                                                          • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:5128
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8FB3.bat
                                                                                              46⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:3988
                                                                                              • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:2484
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a90AD.bat
                                                                                                  48⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:5652
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:1348
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9198.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:2348
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:1132
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9263.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:3284
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:1808
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a935D.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:5840
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:2652
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9418.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:6120
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:4512
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9503.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:3984
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:4736
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a95FD.bat
                                                                                                                          60⤵
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:2356
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:4808
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a96D7.bat
                                                                                                                              62⤵
                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                              PID:5328
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                63⤵
                                                                                                                                • Drops file in Windows directory
                                                                                                                                PID:2840
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a97A2.bat
                                                                                                                                  64⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  PID:764
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                    65⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:3040
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a986E.bat
                                                                                                                                      66⤵
                                                                                                                                        PID:5576
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                          67⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          PID:1792
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9929.bat
                                                                                                                                            68⤵
                                                                                                                                              PID:4164
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                69⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                PID:3308
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A13.bat
                                                                                                                                                  70⤵
                                                                                                                                                    PID:4880
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                      71⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:4536
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9ADF.bat
                                                                                                                                                        72⤵
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:4796
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                          73⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                          PID:560
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9BD9.bat
                                                                                                                                                            74⤵
                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                            PID:1324
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                              75⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                              PID:2268
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9CB3.bat
                                                                                                                                                                76⤵
                                                                                                                                                                  PID:5928
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                    77⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:6028
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D7E.bat
                                                                                                                                                                      78⤵
                                                                                                                                                                        PID:2796
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                          79⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                          PID:4452
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E69.bat
                                                                                                                                                                            80⤵
                                                                                                                                                                              PID:2120
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                81⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                PID:5980
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F34.bat
                                                                                                                                                                                  82⤵
                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  PID:6092
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                    83⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    PID:2208
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9FFF.bat
                                                                                                                                                                                      84⤵
                                                                                                                                                                                        PID:1824
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                          85⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          PID:5280
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA0E9.bat
                                                                                                                                                                                            86⤵
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:4832
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                              87⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              PID:5736
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA1B5.bat
                                                                                                                                                                                                88⤵
                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                PID:832
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                  89⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  PID:5932
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA29F.bat
                                                                                                                                                                                                    90⤵
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:4364
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                      91⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      PID:4144
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA35A.bat
                                                                                                                                                                                                        92⤵
                                                                                                                                                                                                          PID:3684
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                            93⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            PID:680
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA435.bat
                                                                                                                                                                                                              94⤵
                                                                                                                                                                                                                PID:1300
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                  95⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  PID:1652
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA500.bat
                                                                                                                                                                                                                    96⤵
                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                    PID:3884
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                      97⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      PID:2580
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA5FA.bat
                                                                                                                                                                                                                        98⤵
                                                                                                                                                                                                                          PID:5764
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                            99⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            PID:4104
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA6E5.bat
                                                                                                                                                                                                                              100⤵
                                                                                                                                                                                                                                PID:632
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                  101⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:1836
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA7BF.bat
                                                                                                                                                                                                                                    102⤵
                                                                                                                                                                                                                                      PID:4432
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                        103⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        PID:4496
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA88B.bat
                                                                                                                                                                                                                                          104⤵
                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                          PID:2380
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                            105⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                            PID:2036
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA975.bat
                                                                                                                                                                                                                                              106⤵
                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                              PID:1424
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                107⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                PID:4828
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA50.bat
                                                                                                                                                                                                                                                  108⤵
                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                  PID:1708
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                    109⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    PID:3024
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB1B.bat
                                                                                                                                                                                                                                                      110⤵
                                                                                                                                                                                                                                                        PID:4428
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                          111⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:4368
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aABD6.bat
                                                                                                                                                                                                                                                            112⤵
                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                            PID:5404
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                              113⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                              PID:4676
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aACB1.bat
                                                                                                                                                                                                                                                                114⤵
                                                                                                                                                                                                                                                                  PID:604
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                    115⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    PID:4692
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD7C.bat
                                                                                                                                                                                                                                                                      116⤵
                                                                                                                                                                                                                                                                        PID:1212
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                          117⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:5688
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE57.bat
                                                                                                                                                                                                                                                                            118⤵
                                                                                                                                                                                                                                                                              PID:3756
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                119⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                PID:5916
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB04B.bat
                                                                                                                                                                                                                                                                                  120⤵
                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                  PID:4740
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                    121⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    PID:2456
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB0F7.bat
                                                                                                                                                                                                                                                                                      122⤵
                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                      PID:2520
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                        123⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        PID:2476
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB1B2.bat
                                                                                                                                                                                                                                                                                          124⤵
                                                                                                                                                                                                                                                                                            PID:1560
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                              125⤵
                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                              PID:3940
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB25E.bat
                                                                                                                                                                                                                                                                                                126⤵
                                                                                                                                                                                                                                                                                                  PID:4860
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                    127⤵
                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                    PID:3788
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB31A.bat
                                                                                                                                                                                                                                                                                                      128⤵
                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                      PID:3944
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                        129⤵
                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                        PID:4396
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB3D5.bat
                                                                                                                                                                                                                                                                                                          130⤵
                                                                                                                                                                                                                                                                                                            PID:4176
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                              131⤵
                                                                                                                                                                                                                                                                                                                PID:5812
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB491.bat
                                                                                                                                                                                                                                                                                                                  132⤵
                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                  PID:5152
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                    133⤵
                                                                                                                                                                                                                                                                                                                      PID:2700
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB53D.bat
                                                                                                                                                                                                                                                                                                                        134⤵
                                                                                                                                                                                                                                                                                                                          PID:5728
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                            135⤵
                                                                                                                                                                                                                                                                                                                              PID:3632
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB5E8.bat
                                                                                                                                                                                                                                                                                                                                136⤵
                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                PID:860
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                  137⤵
                                                                                                                                                                                                                                                                                                                                    PID:5460
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB6D3.bat
                                                                                                                                                                                                                                                                                                                                      138⤵
                                                                                                                                                                                                                                                                                                                                        PID:4200
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                          139⤵
                                                                                                                                                                                                                                                                                                                                            PID:1508
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB77F.bat
                                                                                                                                                                                                                                                                                                                                              140⤵
                                                                                                                                                                                                                                                                                                                                                PID:5936
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                  141⤵
                                                                                                                                                                                                                                                                                                                                                    PID:3900
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB82B.bat
                                                                                                                                                                                                                                                                                                                                                      142⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                      PID:4208
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                        143⤵
                                                                                                                                                                                                                                                                                                                                                          PID:2948
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB8F6.bat
                                                                                                                                                                                                                                                                                                                                                            144⤵
                                                                                                                                                                                                                                                                                                                                                              PID:1996
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                145⤵
                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                PID:6084
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB9B1.bat
                                                                                                                                                                                                                                                                                                                                                                  146⤵
                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                  PID:3184
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                    147⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:5020
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA4D.bat
                                                                                                                                                                                                                                                                                                                                                                        148⤵
                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                        PID:5824
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                          149⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:2148
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBAF9.bat
                                                                                                                                                                                                                                                                                                                                                                              150⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:5716
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                  151⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                  PID:1504
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBBD4.bat
                                                                                                                                                                                                                                                                                                                                                                                    152⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    PID:1844
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                      153⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:4252
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC80.bat
                                                                                                                                                                                                                                                                                                                                                                                          154⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                          PID:4988
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                            155⤵
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            PID:3460
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD1C.bat
                                                                                                                                                                                                                                                                                                                                                                                              156⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                              PID:1660
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                157⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2444
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBDE7.bat
                                                                                                                                                                                                                                                                                                                                                                                                    158⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2588
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        159⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4440
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBEA3.bat
                                                                                                                                                                                                                                                                                                                                                                                                          160⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2744
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              161⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4012
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF5E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                162⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1744
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2872
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC01A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                    164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2232
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2400
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC0D5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                            166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1700
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4684
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC162.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                  168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3452
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4172
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC21D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                        170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5024
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4472
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC317.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                              172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1380
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2740
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC3B4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                  174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2860
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3672
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC460.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                        176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4628
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1284
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC4FC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                              178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC598.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC634.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC6E0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC77C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC819.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC8D4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC990.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA3C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCAD8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB84.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC20.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCCAD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD49.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCDD5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE81.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF0E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCFBA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD056.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD0E3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD16F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD20C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD2B7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD363.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD3F0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD47D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD519.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD5A5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD642.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD6AF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD71C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD799.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD807.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD884.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD93F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD9DC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA97.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDB53.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDBDF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC6C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD08.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD95.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE21.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDEAE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF3B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDFD7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE063.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE0E0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE15D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE1DA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE267.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE2F4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE380.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE3FD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE48A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE507.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE594.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE630.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE6CC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE749.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE7E5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE872.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE8EF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          302⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              303⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE98B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                304⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  305⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA08.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      306⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          307⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA85.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              308⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                309⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB12.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    310⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      311⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB9E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        312⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            313⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEC0C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              314⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  315⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEC89.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      316⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        317⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED15.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          318⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            319⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED83.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                320⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    321⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE00.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      322⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          323⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE6D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            324⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              325⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF19.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                326⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    327⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF86.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      328⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        329⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEFF4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          330⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            331⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF061.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              332⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                333⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF0CF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  334⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    335⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF14C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        336⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            337⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF1A9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              338⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  339⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF236.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    340⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      341⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5312
                                                                                                                                                                                                                                                                • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                  C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                  • Creates a file in the Startup directory
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                  • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                  PID:2396
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                    net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                    PID:3204
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                        PID:3420

                                                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                                                      MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                      Reconnaissance

                                                                                                                                                                                                                                                                      Resource Development

                                                                                                                                                                                                                                                                      Initial Access

                                                                                                                                                                                                                                                                      Execution

                                                                                                                                                                                                                                                                      Command and Scripting Interpreter

                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                      T1059

                                                                                                                                                                                                                                                                      Windows Command Shell

                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                      T1059.003

                                                                                                                                                                                                                                                                      Persistence

                                                                                                                                                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                      T1547

                                                                                                                                                                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                      T1547.001

                                                                                                                                                                                                                                                                      Privilege Escalation

                                                                                                                                                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                      T1547

                                                                                                                                                                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                      T1547.001

                                                                                                                                                                                                                                                                      Defense Evasion

                                                                                                                                                                                                                                                                      Credential Access

                                                                                                                                                                                                                                                                      Credentials from Password Stores

                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                      T1555

                                                                                                                                                                                                                                                                      Credentials from Web Browsers

                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                      T1555.003

                                                                                                                                                                                                                                                                      Unsecured Credentials

                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                      T1552

                                                                                                                                                                                                                                                                      Credentials In Files

                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                      T1552.001

                                                                                                                                                                                                                                                                      Discovery

                                                                                                                                                                                                                                                                      Peripheral Device Discovery

                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                      T1120

                                                                                                                                                                                                                                                                      Query Registry

                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                      T1012

                                                                                                                                                                                                                                                                      System Information Discovery

                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                      T1082

                                                                                                                                                                                                                                                                      System Location Discovery

                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                      T1614

                                                                                                                                                                                                                                                                      System Language Discovery

                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                      T1614.001

                                                                                                                                                                                                                                                                      System Network Configuration Discovery

                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                      T1016

                                                                                                                                                                                                                                                                      Lateral Movement

                                                                                                                                                                                                                                                                      Collection

                                                                                                                                                                                                                                                                      Data from Local System

                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                      T1005

                                                                                                                                                                                                                                                                      Command and Control

                                                                                                                                                                                                                                                                      Exfiltration

                                                                                                                                                                                                                                                                      Impact

                                                                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                                                                      $$a1A16.bat
                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a1A16.bat
                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                      • SHA256 ce9ed07c163a8db232a5b678955da2d18e2f4825310793c0f89008815fa6acb9
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      $$a1BCB.bat
                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a1BCB.bat
                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                      • SHA256 57d55ad8d1e76ac640b22df7779fb334b45d11afe456a24443884b056bb55379
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      $$a20AD.bat
                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a20AD.bat
                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                      • SHA256 3158ff2d46a90926084d36919f801048a66d7f64513d927a945dce6115e13692
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      $$a2495.bat
                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a2495.bat
                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                      • SHA256 b978ca5d7425bc93c744f8dfdb814feb54e2812c5eb98977ef3843aa1e2ac140
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      $$a2939.bat
                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a2939.bat
                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                      • SHA256 c1d0ed41012fa5d4be1935e44cd966836f388a2d53bb3bfb796f8a0d9e7007b3
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      $$a2DEC.bat
                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a2DEC.bat
                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                      • SHA256 e1bf32c3b533464c057531ed77db74da72e4d5fea31d6cd12cda91c6d051a524
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      $$a3714.bat
                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a3714.bat
                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                      • SHA256 fad024aeeb7095c7c2c866e9087ad0bfde23446886fb6da568614a7cdddd4cdf
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      $$a3C44.bat
                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a3C44.bat
                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                      • SHA256 1b46507d9c122460f9eee93d5c88e7fd4668ec6ac92499755c6043eda5814bb0
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      $$a4E36.bat
                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a4E36.bat
                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                      • SHA256 1f61a77aac651b046e7a07ccbc29dea53993cc548217513a8f0cbce285320a02
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      $$a5431.bat
                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a5431.bat
                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                      • SHA256 e5ea9cb77eee1801f045254cfc08653130aadfe3626e81abd9cd817d859ca92b
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      $$a56F0.bat
                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a56F0.bat
                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                      • SHA256 274b2faaf3d3b4663856d136df6c8d8ce739123acb2e664d46a7449e851f34fb
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      $$a5C7E.bat
                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a5C7E.bat
                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                      • SHA256 7c71d68e12829637aa2a86b50a1f7143648ca95b5b5314d0b6bc6a7d39e3f131
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      $$a6623.bat
                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a6623.bat
                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                      • SHA256 833a67f78ad928b9afccc55180da5ee6bc828458b1508668b87214f098896f2c
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      $$a6AA7.bat
                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a6AA7.bat
                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                      • SHA256 7895a6dc561a612855f1f9514b2e7c55e14f9eb7bb1076390dee0af30cd14b37
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      $$a6EAE.bat
                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a6EAE.bat
                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                      • SHA256 9522d6fc3292d36a338158587860076b129961408622c49bb7834ca2b9295ed1
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      $$a7390.bat
                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a7390.bat
                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                      • SHA256 e80150e59d38d933a4140b6954204e3b9d64219add7d01e245f435a69c6c4bb5
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      $$a7778.bat
                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a7778.bat
                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                      • SHA256 2cb9a1601b26178522c33b6d7aa66b98a015714f782347125d5b55c2edd7788a
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      $$a7BDD.bat
                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a7BDD.bat
                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                      • SHA256 b0566613cbfbdd97fe8943f6b61dda2baec2dbf6d3a6636a3e7954338499b271
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      $$a80A0.bat
                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a80A0.bat
                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                      • SHA256 937f9755c35cbf0c07e7c9bbcd09d3384d4aa6a77cb86b749b982fbe775ab27d
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      $$a8563.bat
                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a8563.bat
                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                      • SHA256 56529f4f805d75dc09bf8c5272aaa68f551a909b51fe9b9f9f2ea00796bb96e0
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      $$a8A16.bat
                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a8A16.bat
                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                      • SHA256 7d932fc47ce86af2f802d462b3595f2abcfc5045fbdd40d330bc4cebb04ec1f8
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe.exe
                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe.exe
                                                                                                                                                                                                                                                                      • Size 5.6MB
                                                                                                                                                                                                                                                                      • SHA256 a93c26487f943dcfbec34d3c0ea771fde1565a0918505ab52d55972ce85a8a06
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe.exe
                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe.exe
                                                                                                                                                                                                                                                                      • Size 5.5MB
                                                                                                                                                                                                                                                                      • SHA256 0a4a7d9a56f9fbc4f8fad21729eaf9a49e04b555734486b4deba3af4c179fc4c
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe.exe
                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe.exe
                                                                                                                                                                                                                                                                      • Size 5.4MB
                                                                                                                                                                                                                                                                      • SHA256 074f43585f6bb05a5568d34bffe73be7ed91f328d8264bd54dca797eb0de99db
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe.exe
                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe.exe
                                                                                                                                                                                                                                                                      • Size 5.5MB
                                                                                                                                                                                                                                                                      • SHA256 38109fee089d3525fde3337eb0a622bf60e82e9a4bb0ae4bc0ee1f7b22265102
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe.exe
                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe.exe
                                                                                                                                                                                                                                                                      • Size 5.5MB
                                                                                                                                                                                                                                                                      • SHA256 156f7d77a43a8d0c9b319fc80e4a23650965d142697bcdb3f78cf7ccab3f9708
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe.exe
                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe.exe
                                                                                                                                                                                                                                                                      • Size 5.4MB
                                                                                                                                                                                                                                                                      • SHA256 39eeecef9ee87faf86cb817d7d97a194ab627aefde324846740ffaa9a242ee2f
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe.exe
                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe.exe
                                                                                                                                                                                                                                                                      • Size 5.4MB
                                                                                                                                                                                                                                                                      • SHA256 6a86320c35f7110407701f6c4f976527e9ec393f202ae3d5319c37df5f785866
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe.exe
                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe.exe
                                                                                                                                                                                                                                                                      • Size 5.3MB
                                                                                                                                                                                                                                                                      • SHA256 58cb091790b5829aae11c48dc306e437bf8f5fdc9fa009b961a57f87d1da25b2
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe.exe
                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe.exe
                                                                                                                                                                                                                                                                      • Size 5.6MB
                                                                                                                                                                                                                                                                      • SHA256 523f43e18de0fcade122693c4dea0eb63599d32da3a9c6469dc2173671707687
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe.exe
                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe.exe
                                                                                                                                                                                                                                                                      • Size 5.6MB
                                                                                                                                                                                                                                                                      • SHA256 617feaead3af8bc799660743212e2bc756cc5dd9b35cb953b91ff6e9de8c9173
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe.exe
                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe.exe
                                                                                                                                                                                                                                                                      • Size 5.3MB
                                                                                                                                                                                                                                                                      • SHA256 c3123ca3c9582d6a9f2345831704c5ef7da6f030153684a9b1abe876310fdd31
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe.exe
                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe.exe
                                                                                                                                                                                                                                                                      • Size 5.2MB
                                                                                                                                                                                                                                                                      • SHA256 fdf5bba1cc36399a3a8e610e72e42fa9381afe9c9998611c788c92067b60f2dd
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe.exe
                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe.exe
                                                                                                                                                                                                                                                                      • Size 5.3MB
                                                                                                                                                                                                                                                                      • SHA256 a9a77ed3f394c73839e8a6dfd9e358c10dd66acd824480ff7b7fd4be1945716f
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe.exe
                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe.exe
                                                                                                                                                                                                                                                                      • Size 5.2MB
                                                                                                                                                                                                                                                                      • SHA256 599275124a9f0350a246052aeab73e85e45e1997f027625611ab9d972bb6ae2c
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe.exe
                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe.exe
                                                                                                                                                                                                                                                                      • Size 5.8MB
                                                                                                                                                                                                                                                                      • SHA256 0fbdd0db9a410e7d6407e57be9b24ce15845df3df0df664747e5a0dec3da97a7
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe.exe
                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe.exe
                                                                                                                                                                                                                                                                      • Size 5.8MB
                                                                                                                                                                                                                                                                      • SHA256 f3b6abb9791b800720e7cd17cc0633a64e4789f6bb3d0c88157894309b305ffe
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe.exe
                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe.exe
                                                                                                                                                                                                                                                                      • Size 5.8MB
                                                                                                                                                                                                                                                                      • SHA256 4c35c4f33b54ef5781a07f09e1b23f320cd805b505d5fe601d1e23bc30e89c48
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe.exe
                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe.exe
                                                                                                                                                                                                                                                                      • Size 5.7MB
                                                                                                                                                                                                                                                                      • SHA256 9952ee90fa00b3b7c861a668db66ac00f0a917195727076d95632b57d5fef223
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe.exe
                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe.exe
                                                                                                                                                                                                                                                                      • Size 5.7MB
                                                                                                                                                                                                                                                                      • SHA256 4d78405ed245ca38fa9db24b9968dc7d4244824a914bb4de14f88cd58c74755b
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe.exe
                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\3739990b036cc6bf60d2f8ce542406663cbb5949e02e227bf7af0c14839e76a3.exe.exe
                                                                                                                                                                                                                                                                      • Size 5.7MB
                                                                                                                                                                                                                                                                      • SHA256 afc6c9ebd58292183e211b8682384fa02f9f216847337a13d8d222408c13a3c5
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      Logo1_.exe
                                                                                                                                                                                                                                                                      • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                      • Size 32KB
                                                                                                                                                                                                                                                                      • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      _desktop.ini
                                                                                                                                                                                                                                                                      • Path F:\$RECYCLE.BIN\_desktop.ini
                                                                                                                                                                                                                                                                      • Size 10B
                                                                                                                                                                                                                                                                      • SHA256 6f32c14d8a0712d435829019df23525a5b62bb2ca9b24874a6316ec374b3d04c
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      memory/124-8653-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/240-8765-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/244-9018-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/256-8955-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/264-66-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/560-8266-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/572-8906-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/576-9053-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/680-8326-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/772-8976-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/1124-8625-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/1132-8204-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/1160-8800-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/1284-8604-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/1348-8198-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/1412-5871-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/1428-8877-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/1500-8891-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/1504-8513-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/1508-8471-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/1588-9046-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/1652-8332-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/1740-8856-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/1776-8751-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/1792-8248-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/1804-1841-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/1808-8210-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/1836-8350-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/1848-8990-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/1944-9011-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/1984-8639-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/2016-8835-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/2036-8362-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/2076-8109-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/2124-8695-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/2148-8506-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/2196-8786-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/2208-8296-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/2228-8920-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/2268-8272-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/2396-617-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/2396-8101-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/2396-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/2396-3178-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/2400-8562-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/2444-8534-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/2456-8410-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/2476-8416-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/2484-8192-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/2580-8338-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/2640-8136-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/2652-8216-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/2668-8821-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/2700-8449-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/2712-9025-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/2740-8590-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/2760-8962-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/2784-8793-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/2840-8236-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/2856-5561-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/2872-8555-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/2888-8870-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/2920-8983-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/2948-8485-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/2976-8646-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/3024-8374-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/3032-8154-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/3040-8242-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/3080-8681-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/3128-8716-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/3260-8758-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/3264-9060-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/3308-8254-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/3316-9004-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/3376-8618-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/3404-53-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/3412-8127-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/3460-8527-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/3476-8723-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/3500-8997-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/3548-8913-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/3588-8737-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/3632-8456-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/3672-8597-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/3688-8632-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/3788-8428-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/3816-8145-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/3900-8478-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/3940-8422-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/3952-2023-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/4000-9039-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/4008-8863-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/4012-8548-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/4104-8344-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/4144-8320-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/4172-8576-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/4244-8772-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/4252-8520-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/4368-8380-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/4396-8435-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/4420-8674-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/4440-8541-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/4452-8284-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/4472-8583-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/4496-8356-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/4508-38-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/4512-8222-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/4536-8260-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/4564-8941-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/4596-8969-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/4600-8611-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/4608-6053-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/4632-8163-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/4676-8386-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/4684-8569-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/4692-8392-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/4708-8884-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/4716-25-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/4716-20-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/4724-8688-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/4736-8228-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/4748-8660-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/4772-8118-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/4808-8230-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/4828-8368-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/4864-8849-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/4908-8172-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/4924-13-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/4924-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/4976-8899-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/5020-8499-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/5032-8667-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/5128-8186-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/5240-8179-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/5276-8842-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/5280-8302-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/5332-6040-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/5428-8097-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/5456-8779-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/5460-8464-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/5464-8828-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/5508-8744-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/5644-8709-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/5688-8398-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/5712-77-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/5732-8730-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/5736-8308-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/5788-8814-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/5792-8702-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/5812-8442-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/5876-9032-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/5916-8404-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/5932-8314-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/5980-8290-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/5992-8927-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/6000-8934-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/6004-8807-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/6028-8278-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/6032-8948-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                      memory/6084-8492-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                      Download