Overview

overview

7

Static

static

3

4acb82421d...1b.exe

windows10-2004-x64

7

4acb82421d...1b.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    127s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/10/2026, 09:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
  • Size 6.0MB
  • Sample261011-lplgmsfe98
  • SHA256 4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
    "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5144
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a403B.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1048
      • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
        "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:3128
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4220.bat
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4944
          • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
            "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:4852
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a482B.bat
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:1460
              • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:5868
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4C42.bat
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:1896
                  • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                    "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:2312
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a50B6.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3068
                      • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                        "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:2032
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5692.bat
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:2632
                          • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                            "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                            13⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:3728
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E72.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:5444
                              • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:1228
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a74B9.bat
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:5168
                                  • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                    "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:4432
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7CA8.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:4408
                                      • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                        "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:3208
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a82B3.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:5540
                                          • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                            "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:6060
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8CF4.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:4512
                                              • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of WriteProcessMemory
                                                PID:4372
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a91B7.bat
                                                  24⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:5920
                                                  • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:2752
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a95CE.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:5032
                                                      • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:3948
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a99F4.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:1832
                                                          • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:4860
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9DFB.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:3172
                                                              • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:4320
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA270.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:4268
                                                                  • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:3524
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA5EB.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:2520
                                                                      • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:1268
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAAAD.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:1440
                                                                          • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:3008
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE76.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:3432
                                                                              • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:3824
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB339.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:2796
                                                                                  • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:4668
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB80B.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4092
                                                                                      • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:1416
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD2C.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:3644
                                                                                          • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:5628
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE07.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4112
                                                                                              • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4444
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBEC2.bat
                                                                                                  48⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:1656
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:5348
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF8D.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:1876
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:3672
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC078.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:5368
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:5364
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC172.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:3740
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:5456
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC22D.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:5372
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:1644
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC2D9.bat
                                                                                                                      58⤵
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:5864
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:6012
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC385.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:5892
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:200
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC431.bat
                                                                                                                              62⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              PID:5980
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:4488
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC4CD.bat
                                                                                                                                  64⤵
                                                                                                                                    PID:5060
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:3220
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC5A8.bat
                                                                                                                                        66⤵
                                                                                                                                          PID:3324
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                            67⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:2232
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC6A2.bat
                                                                                                                                              68⤵
                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                              PID:1380
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                69⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                PID:5900
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC77C.bat
                                                                                                                                                  70⤵
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:620
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                    71⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:4876
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC8A5.bat
                                                                                                                                                      72⤵
                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:3704
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                        73⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                        PID:3308
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC990.bat
                                                                                                                                                          74⤵
                                                                                                                                                            PID:1168
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                              75⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:5928
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA6A.bat
                                                                                                                                                                76⤵
                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                PID:4828
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                  77⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                  PID:2708
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB45.bat
                                                                                                                                                                    78⤵
                                                                                                                                                                      PID:1728
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                        79⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                        PID:4832
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC01.bat
                                                                                                                                                                          80⤵
                                                                                                                                                                            PID:2288
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                              81⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              PID:4104
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCCAD.bat
                                                                                                                                                                                82⤵
                                                                                                                                                                                  PID:2472
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                    83⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:4612
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD49.bat
                                                                                                                                                                                      84⤵
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:5112
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                        85⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        PID:2816
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCDF5.bat
                                                                                                                                                                                          86⤵
                                                                                                                                                                                            PID:2868
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                              87⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              PID:2360
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE91.bat
                                                                                                                                                                                                88⤵
                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                PID:4960
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                  89⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  PID:4660
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF1E.bat
                                                                                                                                                                                                    90⤵
                                                                                                                                                                                                      PID:2292
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                        91⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:4316
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCFF8.bat
                                                                                                                                                                                                          92⤵
                                                                                                                                                                                                            PID:1372
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                              93⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                              PID:1824
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD0C3.bat
                                                                                                                                                                                                                94⤵
                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                PID:4784
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                  95⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                  PID:2692
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD19E.bat
                                                                                                                                                                                                                    96⤵
                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                    PID:4172
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                      97⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:5564
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD25A.bat
                                                                                                                                                                                                                        98⤵
                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        PID:3052
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                          99⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                          PID:4680
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD325.bat
                                                                                                                                                                                                                            100⤵
                                                                                                                                                                                                                              PID:2468
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                101⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                PID:1120
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD3D1.bat
                                                                                                                                                                                                                                  102⤵
                                                                                                                                                                                                                                    PID:3504
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                      103⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      PID:2968
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD45D.bat
                                                                                                                                                                                                                                        104⤵
                                                                                                                                                                                                                                          PID:2324
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                            105⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                            PID:6040
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD4FA.bat
                                                                                                                                                                                                                                              106⤵
                                                                                                                                                                                                                                                PID:6056
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                  107⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  PID:2148
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD5A5.bat
                                                                                                                                                                                                                                                    108⤵
                                                                                                                                                                                                                                                      PID:5576
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                        109⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        PID:2356
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD642.bat
                                                                                                                                                                                                                                                          110⤵
                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                          PID:5108
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                            111⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            PID:4292
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD70D.bat
                                                                                                                                                                                                                                                              112⤵
                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                              PID:1472
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                113⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                PID:2892
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD7E8.bat
                                                                                                                                                                                                                                                                  114⤵
                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                  PID:4264
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                    115⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                    PID:4160
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD8A3.bat
                                                                                                                                                                                                                                                                      116⤵
                                                                                                                                                                                                                                                                        PID:1200
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                          117⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:2748
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD95F.bat
                                                                                                                                                                                                                                                                            118⤵
                                                                                                                                                                                                                                                                              PID:2320
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                119⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                PID:3112
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD9EB.bat
                                                                                                                                                                                                                                                                                  120⤵
                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                  PID:2000
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                    121⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                    PID:2332
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA87.bat
                                                                                                                                                                                                                                                                                      122⤵
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:4300
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                        123⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        PID:2420
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDB14.bat
                                                                                                                                                                                                                                                                                          124⤵
                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                          PID:2564
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                            125⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:604
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDBC0.bat
                                                                                                                                                                                                                                                                                              126⤵
                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                              PID:804
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                127⤵
                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                PID:3956
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC6C.bat
                                                                                                                                                                                                                                                                                                  128⤵
                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                  PID:2428
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                    129⤵
                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                    PID:1584
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD37.bat
                                                                                                                                                                                                                                                                                                      130⤵
                                                                                                                                                                                                                                                                                                        PID:5072
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                          131⤵
                                                                                                                                                                                                                                                                                                            PID:5960
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE21.bat
                                                                                                                                                                                                                                                                                                              132⤵
                                                                                                                                                                                                                                                                                                                PID:3264
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                  133⤵
                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                  PID:5512
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDECD.bat
                                                                                                                                                                                                                                                                                                                    134⤵
                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                    PID:4520
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                      135⤵
                                                                                                                                                                                                                                                                                                                        PID:5612
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF98.bat
                                                                                                                                                                                                                                                                                                                          136⤵
                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                          PID:3228
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                            137⤵
                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                            PID:1324
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE044.bat
                                                                                                                                                                                                                                                                                                                              138⤵
                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                              PID:2936
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                139⤵
                                                                                                                                                                                                                                                                                                                                  PID:4672
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE0D1.bat
                                                                                                                                                                                                                                                                                                                                    140⤵
                                                                                                                                                                                                                                                                                                                                      PID:5136
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                        141⤵
                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                        PID:4360
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE15D.bat
                                                                                                                                                                                                                                                                                                                                          142⤵
                                                                                                                                                                                                                                                                                                                                            PID:752
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                              143⤵
                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                              PID:5948
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE1EA.bat
                                                                                                                                                                                                                                                                                                                                                144⤵
                                                                                                                                                                                                                                                                                                                                                  PID:4068
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                    145⤵
                                                                                                                                                                                                                                                                                                                                                      PID:1384
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE277.bat
                                                                                                                                                                                                                                                                                                                                                        146⤵
                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                        PID:420
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                          147⤵
                                                                                                                                                                                                                                                                                                                                                            PID:2452
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE303.bat
                                                                                                                                                                                                                                                                                                                                                              148⤵
                                                                                                                                                                                                                                                                                                                                                                PID:5380
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                  149⤵
                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                  PID:5048
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE3A0.bat
                                                                                                                                                                                                                                                                                                                                                                    150⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:2964
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                        151⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:1032
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE44B.bat
                                                                                                                                                                                                                                                                                                                                                                            152⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:5128
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                153⤵
                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                PID:592
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE4F7.bat
                                                                                                                                                                                                                                                                                                                                                                                  154⤵
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:568
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                    155⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                    PID:3936
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE5D2.bat
                                                                                                                                                                                                                                                                                                                                                                                      156⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                      PID:3968
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                        157⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:2900
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE6AD.bat
                                                                                                                                                                                                                                                                                                                                                                                            158⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:4424
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                159⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                PID:4620
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE759.bat
                                                                                                                                                                                                                                                                                                                                                                                                  160⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                  PID:3612
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    161⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2880
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE814.bat
                                                                                                                                                                                                                                                                                                                                                                                                        162⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4468
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          163⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1260
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE8C0.bat
                                                                                                                                                                                                                                                                                                                                                                                                              164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2760
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4864
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE95C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                    166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4152
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2404
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE9E9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5400
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2044
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA76.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3396
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4816
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB02.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                        172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2536
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5096
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEBBE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                              174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6116
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3896
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEC79.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                    176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3148
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2776
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED25.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                          178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3012
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2448
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEDC1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE8C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF48.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF003.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF0BF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF18A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF236.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF301.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF3EB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF4B7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF591.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF63D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF6CA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF747.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF7D3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF850.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF8CD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF94A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF9D7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA93.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFB3E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFBEA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC87.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFD32.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFDCF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFE5B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFEE8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFF65.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a11.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a178.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a214.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a38B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a418.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4B4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a522.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a59F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a60C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6A8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a754.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a89C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a929.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA61.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAEE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB6B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC55.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD30.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDBD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE49.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF92.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a100F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a107C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a10E9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1147.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a11A5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1231.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      302⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          303⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a12CE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            304⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                305⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a135A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  306⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    307⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a13D7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        308⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          309⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1454.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              310⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  311⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a14E1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      312⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          313⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a154E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            314⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              315⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a15CB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                316⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    317⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1648.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      318⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          319⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a16C5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            320⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                321⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1752.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  322⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    323⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a17DF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      324⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          325⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a185C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            326⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                327⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a18E8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    328⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      329⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1984.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          330⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            331⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1A30.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              332⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                333⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1ACD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  334⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    335⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1B59.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      336⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          337⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1BF5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            338⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                339⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1C92.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  340⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    341⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D1E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        342⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          343⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D9B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            344⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              345⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1E28.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                346⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  347⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1EA5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      348⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        349⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1792
                                                                                                                                                                                                                                                                  • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                    C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                    • Creates a file in the Startup directory
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                                                                                                                                    • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                    PID:2828
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                      net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                      PID:2916
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                          PID:4252

                                                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                        Reconnaissance

                                                                                                                                                                                                                                                                        Resource Development

                                                                                                                                                                                                                                                                        Initial Access

                                                                                                                                                                                                                                                                        Execution

                                                                                                                                                                                                                                                                        Command and Scripting Interpreter

                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                        T1059

                                                                                                                                                                                                                                                                        Windows Command Shell

                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                        T1059.003

                                                                                                                                                                                                                                                                        Persistence

                                                                                                                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                        T1547

                                                                                                                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                        T1547.001

                                                                                                                                                                                                                                                                        Privilege Escalation

                                                                                                                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                        T1547

                                                                                                                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                        T1547.001

                                                                                                                                                                                                                                                                        Defense Evasion

                                                                                                                                                                                                                                                                        Credential Access

                                                                                                                                                                                                                                                                        Credentials from Password Stores

                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                        T1555

                                                                                                                                                                                                                                                                        Credentials from Web Browsers

                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                        T1555.003

                                                                                                                                                                                                                                                                        Unsecured Credentials

                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                        T1552

                                                                                                                                                                                                                                                                        Credentials In Files

                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                        T1552.001

                                                                                                                                                                                                                                                                        Discovery

                                                                                                                                                                                                                                                                        Peripheral Device Discovery

                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                        T1120

                                                                                                                                                                                                                                                                        Query Registry

                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                        T1012

                                                                                                                                                                                                                                                                        System Information Discovery

                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                        T1082

                                                                                                                                                                                                                                                                        System Location Discovery

                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                        T1614

                                                                                                                                                                                                                                                                        System Language Discovery

                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                        T1614.001

                                                                                                                                                                                                                                                                        System Network Configuration Discovery

                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                        T1016

                                                                                                                                                                                                                                                                        Lateral Movement

                                                                                                                                                                                                                                                                        Collection

                                                                                                                                                                                                                                                                        Data from Local System

                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                        T1005

                                                                                                                                                                                                                                                                        Command and Control

                                                                                                                                                                                                                                                                        Exfiltration

                                                                                                                                                                                                                                                                        Impact

                                                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                                                        $$a403B.bat
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a403B.bat
                                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                                        • SHA256 f13b0ef50143dba7382bdb406043d2f933db42ffc120c6086b2b5e31254ee8d8
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        $$a4220.bat
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a4220.bat
                                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                                        • SHA256 6af50f2e59c7f8b35c30e5b1950c2a55652413fc3d7303931aeaa3ad646aaf64
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        $$a482B.bat
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a482B.bat
                                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                                        • SHA256 7374b8dfe7edb32cda0340ce9a98231a4619162dd377129bb8c767375ed871ca
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        $$a4C42.bat
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a4C42.bat
                                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                                        • SHA256 5dd878b312b350ef9b2027be89acc7154c07c979dbf4282a49ad82468778d8f2
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        $$a50B6.bat
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a50B6.bat
                                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                                        • SHA256 3407a9e858f2e5ca54701248e7b056036d36d4eff6d5c901e7da0970010e546e
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        $$a5692.bat
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a5692.bat
                                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                                        • SHA256 f080e11b3984713be57e4434cfa72bbfb8582c148481d99d656806fa74c823fa
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        $$a5E72.bat
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a5E72.bat
                                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                                        • SHA256 8191b3b252f2c0c3f3e777f5cdb6dad1be3366673d170c6d1f4e51f906be9a61
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        $$a74B9.bat
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a74B9.bat
                                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                                        • SHA256 8a11b6677aa4988eb8071b19e6441a3adb783f27296fefb7a790fce3d013dbab
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        $$a7CA8.bat
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a7CA8.bat
                                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                                        • SHA256 e4c07f50815c1917cf2a6dc74c650e85f318a558e8326a21a3c8fd63c0a69590
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        $$a82B3.bat
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a82B3.bat
                                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                                        • SHA256 fb84fcd974aa5e7dfdc1ed9d503f1ffab10336bcbed4bb4fcc216f08f5e286ce
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        $$a8CF4.bat
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a8CF4.bat
                                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                                        • SHA256 5d8b86a6eac4fed3a7bada7eda8ebdd9f8621a9119e9a040308b83e97c15e556
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        $$a91B7.bat
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a91B7.bat
                                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                                        • SHA256 d223878420816e834fa3ceb6bdb28b42bb3af3e756a6adec8d023329d694fc96
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        $$a95CE.bat
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a95CE.bat
                                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                                        • SHA256 ae9ee0bab16084637d4ef9fd21e3e22b43049baa13ecceb907480d0d12743160
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        $$a99F4.bat
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a99F4.bat
                                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                                        • SHA256 6ae3864e72f76fecb4332f9e01c837dbbfd94df614fbfb47dfac72ec8cdfa54e
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        $$a9DFB.bat
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a9DFB.bat
                                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                                        • SHA256 555f5f893487f76026011b7d78275f44bb91259e863541356522d3a6ce34f03c
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        $$aA270.bat
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aA270.bat
                                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                                        • SHA256 9da8810662d6cf2edb184c16291781cddb7d830a9bf46a9adddcc454e8b4a361
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        $$aA5EB.bat
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aA5EB.bat
                                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                                        • SHA256 397fbef690faec51113b1a4079aa83e67a0836381f887b424b4ea2f5673e6db0
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        $$aAAAD.bat
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aAAAD.bat
                                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                                        • SHA256 fa6bd97c1d1f2d72ec88615cd80db935b6f053bf93a9b4a8c1ecd01ebf08375c
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        $$aAE76.bat
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aAE76.bat
                                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                                        • SHA256 6dd3dab5fcac7b700b80623451181794b3e491de6b90e958f0c3c95dc1366b55
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        $$aB339.bat
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aB339.bat
                                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                                        • SHA256 6aa31d2184bb9be838e6d612cf47a3a1e2a1fbadf4699e383be06a144e4d5d76
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        $$aB80B.bat
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aB80B.bat
                                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                                        • SHA256 b8e8c8b49699be1348cccae87fea81bc5579896ca8281d328df4c3dc3bc7fe78
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe.exe
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe.exe
                                                                                                                                                                                                                                                                        • Size 5.9MB
                                                                                                                                                                                                                                                                        • SHA256 f982c77997fd6ed759cfcaa372e5bd73ad5a66b004b7e270179fb8ee45b1d249
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe.exe
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe.exe
                                                                                                                                                                                                                                                                        • Size 5.8MB
                                                                                                                                                                                                                                                                        • SHA256 639578cb7dbf5b7eebba5754c11cbf52890f2c8fe7465f73fa8e181a30824294
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe.exe
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe.exe
                                                                                                                                                                                                                                                                        • Size 5.7MB
                                                                                                                                                                                                                                                                        • SHA256 8ee74cffb5a685434a4d7ea27f6b545a0fd9bbf6fee64f1ddc8e5b970b118390
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe.exe
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe.exe
                                                                                                                                                                                                                                                                        • Size 5.7MB
                                                                                                                                                                                                                                                                        • SHA256 5d7c8358fec90ebc5dd259ce1af7f3c884e51f37fdf7a9ecb6c8676f61b8d304
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe.exe
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe.exe
                                                                                                                                                                                                                                                                        • Size 5.6MB
                                                                                                                                                                                                                                                                        • SHA256 6bcbef547eb3cdfc7a914549157b883221be9136f7aa4f7bef8853d3cffb17eb
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe.exe
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe.exe
                                                                                                                                                                                                                                                                        • Size 5.3MB
                                                                                                                                                                                                                                                                        • SHA256 2b505ce5cccc7e3e65b5ef23bfbca84a39b506ce412e1a590d4485d4fb14fda8
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe.exe
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe.exe
                                                                                                                                                                                                                                                                        • Size 5.7MB
                                                                                                                                                                                                                                                                        • SHA256 5d330713320318caa1043311daeab47882f1aeb07605b0e603e84a92b0a9ebb3
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe.exe
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe.exe
                                                                                                                                                                                                                                                                        • Size 5.6MB
                                                                                                                                                                                                                                                                        • SHA256 172ad3177440dde47e68e31026c033d87f06bbf509f7e7e6f062616901ace6fd
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe.exe
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe.exe
                                                                                                                                                                                                                                                                        • Size 5.8MB
                                                                                                                                                                                                                                                                        • SHA256 da78bc25e57b38cd2ee05a739cf61b0f97d64e923ce2c0118baa64e782cd2f08
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe.exe
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe.exe
                                                                                                                                                                                                                                                                        • Size 5.6MB
                                                                                                                                                                                                                                                                        • SHA256 5b3dea1d24a1a2f963191dd3d2000fe3f4ed5f2d54c2bef7115ebf78ad93b281
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe.exe
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe.exe
                                                                                                                                                                                                                                                                        • Size 5.5MB
                                                                                                                                                                                                                                                                        • SHA256 b45e4e965812f7e35f32625904dd26e4c732837ba359ab30dea91dc37cf97e0c
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe.exe
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe.exe
                                                                                                                                                                                                                                                                        • Size 5.5MB
                                                                                                                                                                                                                                                                        • SHA256 a9ccf21c351e38c02751970ac40de3fbb3ecb57e8de4e07fff523cd9afe75a74
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe.exe
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe.exe
                                                                                                                                                                                                                                                                        • Size 5.4MB
                                                                                                                                                                                                                                                                        • SHA256 af1d9eed01b2f27c52cc9ed52cdcef20768b386bd19b7cef5ed6545383778f27
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe.exe
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe.exe
                                                                                                                                                                                                                                                                        • Size 5.5MB
                                                                                                                                                                                                                                                                        • SHA256 91e85ea02d6627e735f5f878355de37ebdffd4068610f51da05657de68424236
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe.exe
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe.exe
                                                                                                                                                                                                                                                                        • Size 5.4MB
                                                                                                                                                                                                                                                                        • SHA256 4261b358caa20b27c9eaf79238ddd012b3580a5dbcd295fe32fb859b94c1eba3
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe.exe
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe.exe
                                                                                                                                                                                                                                                                        • Size 5.8MB
                                                                                                                                                                                                                                                                        • SHA256 c52a153bd6c0f8ac0112dddcf42e3b9abb64dcb754c76a380815d313f82d9e0c
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe.exe
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe.exe
                                                                                                                                                                                                                                                                        • Size 5.4MB
                                                                                                                                                                                                                                                                        • SHA256 828832549419690b7a4616fdfb97dce214cde5c403f3d2b68fa7c48a80413801
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe.exe
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe.exe
                                                                                                                                                                                                                                                                        • Size 5.9MB
                                                                                                                                                                                                                                                                        • SHA256 3038db6a6350cc5094c20db096cf997e75f90c643af9cf0e9df3b9ce01260c39
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe.exe
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe.exe
                                                                                                                                                                                                                                                                        • Size 5.9MB
                                                                                                                                                                                                                                                                        • SHA256 f099016773429272c92723b23101036c1eb3be1fc198f961e892fe7ba49f9466
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe.exe
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\4acb82421dfe89cb6dbc6dd5bc410cf6c78b443c712d43b6922eb8c1ef70611b.exe.exe
                                                                                                                                                                                                                                                                        • Size 5.9MB
                                                                                                                                                                                                                                                                        • SHA256 4e5534f6b7da93a9550c092001a3b7ebaa238fa6dfe76d0becf080c5cdde41c0
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        rundl132.exe
                                                                                                                                                                                                                                                                        • Path C:\Windows\rundl132.exe
                                                                                                                                                                                                                                                                        • Size 32KB
                                                                                                                                                                                                                                                                        • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        _desktop.ini
                                                                                                                                                                                                                                                                        • Path F:\$RECYCLE.BIN\_desktop.ini
                                                                                                                                                                                                                                                                        • Size 10B
                                                                                                                                                                                                                                                                        • SHA256 6f32c14d8a0712d435829019df23525a5b62bb2ca9b24874a6316ec374b3d04c
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        memory/108-9110-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/200-8304-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/592-8595-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/604-8496-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/940-8984-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/1032-8588-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/1052-9117-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/1104-8932-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/1120-8424-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/1172-9054-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/1196-8735-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/1228-5550-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/1260-8630-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/1264-8826-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/1268-8215-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/1324-8539-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/1376-8896-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/1384-8567-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/1416-8250-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/1468-8868-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/1584-8511-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/1644-8292-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/1652-8861-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/1808-8742-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/1824-8400-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2032-429-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2044-8651-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2076-9040-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2104-8910-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2148-8442-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2232-8322-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2312-64-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2332-8484-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2352-9089-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2356-8448-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2360-8382-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2388-9033-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2404-8644-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2420-8490-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2432-8700-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2448-8686-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2452-8574-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2504-8812-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2576-8840-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2688-9005-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2692-8406-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2708-8352-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2748-8472-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2752-8170-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2776-8679-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2816-8376-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2828-2917-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2828-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2828-8155-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2828-1025-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2876-8693-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2880-8623-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2892-8460-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2900-8609-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2968-8430-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3008-8224-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3040-8791-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3088-8721-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3104-9082-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3112-8478-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3128-24-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3152-9138-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3156-8763-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3208-6033-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3220-8316-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3252-8889-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3308-8340-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3316-9061-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3356-9068-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3384-8798-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3476-8946-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3496-9026-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3500-8707-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3524-8206-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3560-9131-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3672-8274-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3728-1839-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3824-8233-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3896-8672-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3920-9096-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3936-8602-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3940-8777-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3944-8784-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3948-8179-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3956-8503-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3964-8833-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4084-9075-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4100-8728-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4104-8364-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4120-9103-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4156-8770-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4160-8466-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4292-8454-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4316-8394-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4320-8197-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4360-8553-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4372-8161-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4396-8882-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4432-6020-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4444-8262-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4484-8917-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4488-8310-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4516-8854-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4528-8714-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4600-9124-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4612-8370-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4620-8616-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4632-8749-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4644-8756-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4660-8388-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4668-8243-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4672-8546-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4680-8418-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4700-9012-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4704-8925-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4768-8903-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4780-8977-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4816-8658-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4832-8358-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4852-36-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4860-8188-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4864-8637-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4876-8334-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/5048-8581-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/5096-8665-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/5144-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/5144-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/5228-9047-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/5252-8939-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/5348-8268-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/5364-8280-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/5456-8286-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/5512-8525-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/5536-8819-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/5564-8412-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/5580-8847-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/5588-8956-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/5612-8532-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/5628-8256-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/5632-8805-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/5644-8970-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/5796-8949-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/5852-8991-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/5868-51-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/5900-8328-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/5928-8346-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/5948-8560-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/5960-8518-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/6012-8298-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/6028-8998-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/6036-8963-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/6040-8436-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/6060-8149-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/6128-9019-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/6132-8875-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                        Download