Overview

overview

7

Static

static

3

dada9e4663...4b.exe

windows10-2004-x64

7

dada9e4663...4b.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/10/2026, 10:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
  • Size 5.7MB
  • Sample261011-mbebvaga77
  • SHA256 dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 42 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 2 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
    "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2484
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4694.bat
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:908
      • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
        "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3584
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4A9C.bat
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1956
          • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
            "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4572
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a500A.bat
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1468
              • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:4948
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a54DD.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3988
                  • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                    "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:4200
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5A0D.bat
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:3004
                      • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                        "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of WriteProcessMemory
                        PID:2012
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6141.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:5876
                          • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                            "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:4528
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6817.bat
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:4800
                              • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:3256
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a71FA.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:3536
                                  • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                    "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious use of WriteProcessMemory
                                    PID:4280
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a766E.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:2028
                                      • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                        "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of WriteProcessMemory
                                        PID:3392
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B41.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:4872
                                          • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                            "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:5916
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8061.bat
                                              22⤵
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:5960
                                              • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of WriteProcessMemory
                                                PID:5328
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a84F5.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:2868
                                                  • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:6112
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a891C.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:5772
                                                      • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:1080
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E1D.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:3928
                                                          • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2456
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9243.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:1324
                                                              • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:5920
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a96D7.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:2704
                                                                  • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:2940
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A62.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:3248
                                                                      • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:2396
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E3A.bat
                                                                          36⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:4980
                                                                          • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:1908
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA29F.bat
                                                                              38⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:1572
                                                                              • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:3616
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA6A6.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:4896
                                                                                  • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:5540
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA7B0.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:5360
                                                                                      • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:4740
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA87B.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:4968
                                                                                          • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:4640
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA965.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:1008
                                                                                              • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:5336
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA21.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:5168
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:936
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAAFC.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:2436
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:1496
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aABE6.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:3496
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:1132
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aACFF.bat
                                                                                                              54⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:5284
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:1996
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aADEA.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:4780
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:4568
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAEF3.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:3492
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        PID:3068
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAFDE.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:5260
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            PID:4500
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB116.bat
                                                                                                                              62⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              PID:4244
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Drops file in Windows directory
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:3844
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB210.bat
                                                                                                                                  64⤵
                                                                                                                                    PID:4860
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:4584
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB2EB.bat
                                                                                                                                        66⤵
                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                        PID:4828
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                          67⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          PID:2460
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB3F4.bat
                                                                                                                                            68⤵
                                                                                                                                              PID:5608
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                69⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                PID:4720
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB4DF.bat
                                                                                                                                                  70⤵
                                                                                                                                                    PID:4676
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                      71⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                      PID:5620
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB5C9.bat
                                                                                                                                                        72⤵
                                                                                                                                                          PID:2672
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                            73⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            PID:2212
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB6D3.bat
                                                                                                                                                              74⤵
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:2116
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                75⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                PID:5436
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB7BD.bat
                                                                                                                                                                  76⤵
                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                  PID:4312
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                    77⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:5780
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB8B7.bat
                                                                                                                                                                      78⤵
                                                                                                                                                                        PID:1732
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                          79⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:2500
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB982.bat
                                                                                                                                                                            80⤵
                                                                                                                                                                              PID:3104
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                81⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                PID:3312
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBAAB.bat
                                                                                                                                                                                  82⤵
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  PID:5356
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                    83⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                    PID:5140
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBBB5.bat
                                                                                                                                                                                      84⤵
                                                                                                                                                                                        PID:1900
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                          85⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          PID:3436
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBCAF.bat
                                                                                                                                                                                            86⤵
                                                                                                                                                                                              PID:3384
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                87⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                PID:1512
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD8A.bat
                                                                                                                                                                                                  88⤵
                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                  PID:2220
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                    89⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    PID:6064
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE45.bat
                                                                                                                                                                                                      90⤵
                                                                                                                                                                                                        PID:1448
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                          91⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                          PID:5236
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF10.bat
                                                                                                                                                                                                            92⤵
                                                                                                                                                                                                              PID:1052
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                93⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                PID:636
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBFCC.bat
                                                                                                                                                                                                                  94⤵
                                                                                                                                                                                                                    PID:6032
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                      95⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                      PID:2464
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC097.bat
                                                                                                                                                                                                                        96⤵
                                                                                                                                                                                                                          PID:4172
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                            97⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            PID:1356
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC172.bat
                                                                                                                                                                                                                              98⤵
                                                                                                                                                                                                                                PID:6044
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                  99⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:5348
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC24C.bat
                                                                                                                                                                                                                                    100⤵
                                                                                                                                                                                                                                      PID:3268
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                        101⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        PID:2996
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC317.bat
                                                                                                                                                                                                                                          102⤵
                                                                                                                                                                                                                                            PID:2312
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                              103⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              PID:2016
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC3F2.bat
                                                                                                                                                                                                                                                104⤵
                                                                                                                                                                                                                                                  PID:4772
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                    105⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:2168
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC49E.bat
                                                                                                                                                                                                                                                      106⤵
                                                                                                                                                                                                                                                        PID:5064
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                          107⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          PID:4212
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC579.bat
                                                                                                                                                                                                                                                            108⤵
                                                                                                                                                                                                                                                              PID:5324
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                109⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                PID:920
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC654.bat
                                                                                                                                                                                                                                                                  110⤵
                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                  PID:4856
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                    111⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    PID:1884
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC75D.bat
                                                                                                                                                                                                                                                                      112⤵
                                                                                                                                                                                                                                                                        PID:2740
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                          113⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:2584
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC819.bat
                                                                                                                                                                                                                                                                            114⤵
                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            PID:6056
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                              115⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              PID:1392
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC8D4.bat
                                                                                                                                                                                                                                                                                116⤵
                                                                                                                                                                                                                                                                                  PID:2448
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                    117⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                    PID:4768
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC9FD.bat
                                                                                                                                                                                                                                                                                      118⤵
                                                                                                                                                                                                                                                                                        PID:5684
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                          119⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          PID:6100
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCAE7.bat
                                                                                                                                                                                                                                                                                            120⤵
                                                                                                                                                                                                                                                                                              PID:4704
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                121⤵
                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                PID:3048
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCBD2.bat
                                                                                                                                                                                                                                                                                                  122⤵
                                                                                                                                                                                                                                                                                                    PID:2576
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                      123⤵
                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                      PID:2668
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC7E.bat
                                                                                                                                                                                                                                                                                                        124⤵
                                                                                                                                                                                                                                                                                                          PID:1260
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                            125⤵
                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                            PID:964
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD68.bat
                                                                                                                                                                                                                                                                                                              126⤵
                                                                                                                                                                                                                                                                                                                PID:3136
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                  127⤵
                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                  PID:2072
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE33.bat
                                                                                                                                                                                                                                                                                                                    128⤵
                                                                                                                                                                                                                                                                                                                      PID:1816
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                        129⤵
                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                        PID:1148
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF0E.bat
                                                                                                                                                                                                                                                                                                                          130⤵
                                                                                                                                                                                                                                                                                                                            PID:3168
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                              131⤵
                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                              PID:2684
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCFD9.bat
                                                                                                                                                                                                                                                                                                                                132⤵
                                                                                                                                                                                                                                                                                                                                  PID:3872
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                    133⤵
                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                    PID:2664
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD0D3.bat
                                                                                                                                                                                                                                                                                                                                      134⤵
                                                                                                                                                                                                                                                                                                                                        PID:1696
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                          135⤵
                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                          PID:1716
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD17F.bat
                                                                                                                                                                                                                                                                                                                                            136⤵
                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                            PID:3036
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                              137⤵
                                                                                                                                                                                                                                                                                                                                                PID:5364
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD24A.bat
                                                                                                                                                                                                                                                                                                                                                  138⤵
                                                                                                                                                                                                                                                                                                                                                    PID:2240
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                      139⤵
                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                      PID:3060
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD334.bat
                                                                                                                                                                                                                                                                                                                                                        140⤵
                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                        PID:2712
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                          141⤵
                                                                                                                                                                                                                                                                                                                                                            PID:3520
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD3F0.bat
                                                                                                                                                                                                                                                                                                                                                              142⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                              PID:4516
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                143⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:1548
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD4CB.bat
                                                                                                                                                                                                                                                                                                                                                                    144⤵
                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                    PID:4272
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                      145⤵
                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                      PID:1944
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD577.bat
                                                                                                                                                                                                                                                                                                                                                                        146⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                        PID:5600
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                          147⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:2872
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD622.bat
                                                                                                                                                                                                                                                                                                                                                                              148⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                              PID:1668
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                149⤵
                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                PID:2428
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD6EE.bat
                                                                                                                                                                                                                                                                                                                                                                                  150⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4440
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                      151⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                      PID:4844
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD7A9.bat
                                                                                                                                                                                                                                                                                                                                                                                        152⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:628
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                            153⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                            PID:4448
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD884.bat
                                                                                                                                                                                                                                                                                                                                                                                              154⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:2836
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  155⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1168
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD94F.bat
                                                                                                                                                                                                                                                                                                                                                                                                    156⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                    PID:2888
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      157⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4536
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA1A.bat
                                                                                                                                                                                                                                                                                                                                                                                                          158⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:5628
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              159⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2244
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDAC6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                160⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5484
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    161⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4612
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDB72.bat
                                                                                                                                                                                                                                                                                                                                                                                                                        162⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5688
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2076
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC3D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4540
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4864
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD08.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                        166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2044
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1600
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDDB4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3964
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1660
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE6F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                    170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5956
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3172
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF2B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                            172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5244
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDFF6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE0B2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE17D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE238.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE2D4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE3A0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE44B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE4F7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE5A3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE63F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE6FB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE7A7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE843.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE8EF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE9BA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA85.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB41.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEC0C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aECC7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED73.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE0F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEEAC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF58.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF003.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF0A0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF13C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF1F7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF2D2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF37E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF40B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF4C6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF553.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF5DF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF66C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF708.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF7D3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF87F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF91C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF9C7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA73.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFB00.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFB9C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC38.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFCD5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFDA0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFE5B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFF36.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFFC3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1A7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a234.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2EF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a38B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a437.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4C4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a59F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a62B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a745.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a800.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a88D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a919.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA52.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    302⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      303⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aADE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        304⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            305⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB5B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                306⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  307⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      308⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          309⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC75.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              310⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                311⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD11.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  312⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      313⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDAD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          314⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            315⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE3A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              316⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  317⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      318⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        319⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF63.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            320⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              321⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a100F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  322⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      323⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a10AB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        324⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          325⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1137.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              326⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                327⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a11B4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  328⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    329⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1241.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      330⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        331⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4792
                                                                                                                                                                                                                                                                                                        • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                          20⤵
                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                          • Enumerates connected drives
                                                                                                                                                                                                                                                                                                          • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                          PID:4376
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                            net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                            21⤵
                                                                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                            PID:992
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                              22⤵
                                                                                                                                                                                                                                                                                                                PID:1600
                                                                                                                                                                                                                                                                      • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                        C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                                                                                                                        • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                        PID:2256
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                          net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                          PID:1360
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                              PID:4456
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 992
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                                            PID:2076
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 992
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                                            PID:636
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2256 -ip 2256
                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                          PID:936
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2256 -ip 2256
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                            PID:4456

                                                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                                                                $$a4694.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a4694.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 9ae53309fbbe5639ae4aebecc9a63b513707ee6a5e647f3e1ef9126dfb507db3
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$a4A9C.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a4A9C.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 bee27306f273e1f86717b654bca35819546ae486733b774c6f0528ddb86ce511
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$a500A.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a500A.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 04746a2ec5b4bd4decdf8be0c9821f50bc7d878c680fe8f54e3b1c33cb5e3b7e
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$a54DD.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a54DD.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 c9c280a07091fa1f722e11b38b80089970bb82c9ca108237040981f9b11bea5b
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$a5A0D.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a5A0D.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 8509d0f8fc94780028f5128873ba97a19d94215e98a9cff0eb527776c6c028a5
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$a6141.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a6141.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 bcbebdeea741683aaa41950f51d229df57f478ba948f4dcac5caee35bf4f4785
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$a6817.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a6817.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 8bed5e1402494a235417b1ed17ad1309737202a1e5516517631606605ed49418
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$a71FA.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a71FA.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 f9935a9d37462e948d60b58c531c6708e3289b0d0b0f7a5c0dcbfe126d21f74f
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$a766E.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a766E.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 64f62196911062cd55f26b35a004ae497fb6bba1303b7795898f187946c2baf4
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$a7B41.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a7B41.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 efd392a1e50a2748e1529155123d03a4ba82a3b85af85a9c20d3a8224e4339c7
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$a8061.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a8061.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 bb7b02d2f73651b2334f236b9d5cbf76b97f033f97ceac904a67dc4fc1148490
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$a84F5.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a84F5.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 bc552cc5698913e9e7a43c05822594c897a80c7dcac9f3bbdbb15827ea457136
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$a891C.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a891C.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 8f0d3cc71afbc6f7f865061ffbd48e32903c0f0759f76f37841ed139268478e1
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$a8E1D.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a8E1D.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 fb49979222f633e3032d0731107d95e95ebbb2bb0287ded9ed766f2d32cedad2
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$a9243.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a9243.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 66625edfc02dfa6d812a5800197eb1ca8b6684cbcfef37b593b436b16998700e
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$a96D7.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a96D7.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 1740071c66dc49b0327e9514015c564323107b29eec2cf109966cf765547d0b7
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$a9A62.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a9A62.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 f9671ba2d6eb4c1f8e799234a8bd6f4b6460026817e4b7dbf749126eb44afdd2
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$a9E3A.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a9E3A.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 3caaf691840ed3765fef9ba9091aea7bbdae1a98453431a60a15c340b6c962ea
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.3MB
                                                                                                                                                                                                                                                                                • SHA256 f8ad8679ba23ac88db04d4d49b1fe3da85f0c24d00e67fbb8f233ae93296ca84
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.2MB
                                                                                                                                                                                                                                                                                • SHA256 cf046419b6c4413bccf33c29449f4b77284563588993d4272ecfbce0544be1ed
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.2MB
                                                                                                                                                                                                                                                                                • SHA256 3c3afa679e4946865a05047c69cee72f20b5222ff3628d5b373b943f48a14271
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.1MB
                                                                                                                                                                                                                                                                                • SHA256 b346e93f5515b3300fcb161ad709bcb29059793794d721b6d29dd548d725b878
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.4MB
                                                                                                                                                                                                                                                                                • SHA256 e4e08ce669cab3cd1b7160d634050ea16b590d09115ae92106b8cc19bca655ce
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.4MB
                                                                                                                                                                                                                                                                                • SHA256 f9e5a6488dd25622cf44f1c13e6b3d7a51831cd53efabc20c7a66ae62f8a6ff4
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.7MB
                                                                                                                                                                                                                                                                                • SHA256 0bc21358f2bd7afd605e3553dec0d31d8148b2c192e5f5a031c7c7f49ef622fd
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.5MB
                                                                                                                                                                                                                                                                                • SHA256 72cd98ba3feaa3b2ff43520fe22b04d6b927f47f8c3298b42eb9b6817d0adf4b
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.4MB
                                                                                                                                                                                                                                                                                • SHA256 0f4dc3d4c56a7b85cd2e90e0e6edfc110d28aa771edf6ea369812ff6c7fdfed0
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.3MB
                                                                                                                                                                                                                                                                                • SHA256 de00f16160c25bb9336699b587ed46ba0f0d5de3511c8d4cc12ef6b4004215c7
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.5MB
                                                                                                                                                                                                                                                                                • SHA256 6a97aed0b69a44b856275fc62c816efa9abb432c1d01f6df592a7526375c74bf
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.3MB
                                                                                                                                                                                                                                                                                • SHA256 72ad9f416dd2ad595d43c2263acfe55f8c0d7078f8254d1a3a71a2160a5289ef
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.6MB
                                                                                                                                                                                                                                                                                • SHA256 5e79157840e384cb7d1109b27b186cd611a10ece448f8923ebc818789c0cd03b
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.2MB
                                                                                                                                                                                                                                                                                • SHA256 8daed99afb6f19928e89623bf0fb1ad0bf7da34e0ef26c038646dc7ed5d85dec
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.5MB
                                                                                                                                                                                                                                                                                • SHA256 7541f8754119ac1a8109084a57c3f1b68e6816f22d93200ea129e6d97cf32228
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.1MB
                                                                                                                                                                                                                                                                                • SHA256 35c825af127ab132c78fb9b6900fee9988065dd560d6138bf8e08f314ca7e019
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.6MB
                                                                                                                                                                                                                                                                                • SHA256 52ea46a35c85cd2c1ceb7f0131b1808df5aed8892ad290e7f874d87d0e19f43b
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\dada9e4663a384e1f7eac618283a6ff70e9bd60632e7a522716e09d6326df34b.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.6MB
                                                                                                                                                                                                                                                                                • SHA256 76d2889f2a9440f9016a55043f776076a62cea1b44f491116135367a783d025d
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                Dll.dll
                                                                                                                                                                                                                                                                                • Path C:\Windows\Dll.dll
                                                                                                                                                                                                                                                                                • Size 68KB
                                                                                                                                                                                                                                                                                • SHA256 58902ae17338af4211e7e21eddb09671507b48740fa7056b9b7f7ab307da0168
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                Logo1_.exe
                                                                                                                                                                                                                                                                                • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                • Size 32KB
                                                                                                                                                                                                                                                                                • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                _desktop.ini
                                                                                                                                                                                                                                                                                • Path F:\$RECYCLE.BIN\_desktop.ini
                                                                                                                                                                                                                                                                                • Size 10B
                                                                                                                                                                                                                                                                                • SHA256 6f32c14d8a0712d435829019df23525a5b62bb2ca9b24874a6316ec374b3d04c
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                memory/200-3649-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/636-3200-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/800-3733-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/920-3248-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/936-3068-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/960-3810-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/964-3298-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1032-3536-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1076-3543-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1080-2984-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1104-3592-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1132-3080-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1148-3312-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1168-3403-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1208-3824-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1268-3487-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1280-3494-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1288-3515-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1356-3212-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1388-3831-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1392-3266-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1424-3670-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1432-3705-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1496-3074-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1512-3182-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1548-3361-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1600-3445-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1660-3452-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1708-3684-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1716-3333-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1884-3254-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1908-3032-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1908-3027-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1924-3768-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1944-3368-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1980-3712-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1996-3086-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2012-807-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2016-3230-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2072-3305-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2076-3431-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2168-3236-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2212-3140-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2244-3417-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2256-2509-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2256-2927-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2256-1483-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2256-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2392-3747-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2396-3021-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2428-3382-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2456-2994-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2460-3122-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2464-3206-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2480-3634-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2484-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2484-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2500-3158-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2504-3663-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2584-3260-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2600-3726-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2664-3326-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2668-3291-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2684-3319-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2720-3775-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2832-3522-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2848-3677-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2860-3613-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2872-3375-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2940-3012-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2996-3224-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3008-3852-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3040-3887-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3048-3285-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3060-3347-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3068-3098-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3112-3578-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3116-3761-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3120-3564-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3140-3691-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3172-3459-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3204-3529-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3256-2753-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3292-3915-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3312-3164-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3380-3698-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3392-2941-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3436-3176-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3456-3508-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3520-3354-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3528-3656-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3584-24-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3616-3038-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3632-3901-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3664-3838-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3832-3796-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3844-3110-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3868-3480-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3980-3866-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3984-3585-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4108-3501-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4200-66-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4212-3242-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4248-3571-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4280-2924-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4296-3473-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4304-3817-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4376-3268-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4376-2989-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4376-3026-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4448-3396-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4500-3104-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4528-1839-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4536-3410-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4568-3092-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4572-42-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4584-3116-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4612-3424-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4624-3803-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4640-3056-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4644-3789-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4700-3620-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4720-3128-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4740-3050-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4768-3273-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4788-3908-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4844-3389-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4864-3438-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4928-3627-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4932-3557-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4940-3642-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4948-55-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5092-3894-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5104-3466-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5132-3845-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5140-3170-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5152-3719-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5232-3754-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5236-3194-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5264-3873-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5328-2966-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5336-3062-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5348-3218-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5364-3340-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5436-3146-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5496-3606-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5524-3880-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5540-3044-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5620-3134-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5660-3859-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5780-3152-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5884-3550-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5892-3599-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5896-3782-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5916-2955-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5920-3003-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/6064-3188-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/6096-3740-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/6100-3279-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/6112-2975-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download