Overview

overview

7

Static

static

3

c9d004c4e4...a2.exe

windows10-2004-x64

7

c9d004c4e4...a2.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/10/2026, 10:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
  • Size 5.7MB
  • Sample261011-mranlagd68
  • SHA256 c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
    "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4956
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6A1A.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:52
      • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
        "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2852
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6D08.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4428
          • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
            "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2236
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7277.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:5972
              • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:5816
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a769D.bat
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:1224
                  • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                    "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:624
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7BED.bat
                      10⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:3316
                      • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                        "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:3040
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8052.bat
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:2580
                          • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                            "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:5612
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a893B.bat
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:292
                              • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:4360
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B5C.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:4920
                                  • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                    "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:4556
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E1B.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:3676
                                      • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                        "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:1872
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA33B.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:3360
                                          • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                            "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:2180
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA85C.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • Suspicious use of WriteProcessMemory
                                              PID:2268
                                              • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of WriteProcessMemory
                                                PID:3184
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB22F.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:2188
                                                  • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4780
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB6B4.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4180
                                                      • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:3508
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB19.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:1344
                                                          • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2740
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF8D.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:1844
                                                              • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:1588
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC3C3.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:1212
                                                                  • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:4252
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC857.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:1972
                                                                      • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:4868
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD78.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:6128
                                                                          • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:5124
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD21B.bat
                                                                              38⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:4076
                                                                              • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:4356
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD5C5.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:3144
                                                                                  • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:3668
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD97E.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:620
                                                                                      • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:5876
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDCE9.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:2864
                                                                                          • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:2112
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD95.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:840
                                                                                              • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:1748
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE50.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:4160
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:5404
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF3B.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:2768
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:3096
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE006.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:5968
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:3944
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE0E0.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:5140
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:2948
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE19C.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:6040
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:5772
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE257.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:3176
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:1152
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE323.bat
                                                                                                                          60⤵
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:796
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:836
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE3EE.bat
                                                                                                                              62⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              PID:5824
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:3808
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE4B9.bat
                                                                                                                                  64⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  PID:1708
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                    65⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:1084
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE5A3.bat
                                                                                                                                      66⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:5648
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                        67⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:2352
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE64F.bat
                                                                                                                                          68⤵
                                                                                                                                            PID:2240
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                              69⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Drops file in Windows directory
                                                                                                                                              PID:5428
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE72A.bat
                                                                                                                                                70⤵
                                                                                                                                                  PID:1416
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                    71⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:4444
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE805.bat
                                                                                                                                                      72⤵
                                                                                                                                                        PID:1108
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                          73⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:2412
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE8C0.bat
                                                                                                                                                            74⤵
                                                                                                                                                              PID:4260
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                75⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:5800
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE96C.bat
                                                                                                                                                                  76⤵
                                                                                                                                                                    PID:5784
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                      77⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                      PID:4804
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA08.bat
                                                                                                                                                                        78⤵
                                                                                                                                                                          PID:5216
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                            79⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            PID:3592
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA95.bat
                                                                                                                                                                              80⤵
                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                              PID:200
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                81⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                PID:3248
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB31.bat
                                                                                                                                                                                  82⤵
                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  PID:2660
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                    83⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:3484
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEBDD.bat
                                                                                                                                                                                      84⤵
                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                      PID:4948
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                        85⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        PID:4824
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aECA8.bat
                                                                                                                                                                                          86⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:4816
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                            87⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:460
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED54.bat
                                                                                                                                                                                              88⤵
                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                              PID:3628
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                89⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                PID:2636
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE0F.bat
                                                                                                                                                                                                  90⤵
                                                                                                                                                                                                    PID:728
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                      91⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      PID:2556
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEEEA.bat
                                                                                                                                                                                                        92⤵
                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                        PID:1240
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                          93⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:4120
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEFD5.bat
                                                                                                                                                                                                            94⤵
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            PID:4944
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                              95⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                              PID:3320
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF0AF.bat
                                                                                                                                                                                                                96⤵
                                                                                                                                                                                                                  PID:4164
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                    97⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                    PID:4144
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF13C.bat
                                                                                                                                                                                                                      98⤵
                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                      PID:4652
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                        99⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        PID:1940
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF1C9.bat
                                                                                                                                                                                                                          100⤵
                                                                                                                                                                                                                            PID:2456
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                              101⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:4764
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF255.bat
                                                                                                                                                                                                                                102⤵
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                PID:4392
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                  103⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:3588
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF2E2.bat
                                                                                                                                                                                                                                    104⤵
                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                    PID:3464
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                      105⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      PID:4216
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF35F.bat
                                                                                                                                                                                                                                        106⤵
                                                                                                                                                                                                                                          PID:5000
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                            107⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                            PID:2968
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF3EB.bat
                                                                                                                                                                                                                                              108⤵
                                                                                                                                                                                                                                                PID:5664
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                  109⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                  PID:4232
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF478.bat
                                                                                                                                                                                                                                                    110⤵
                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                    PID:768
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                      111⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                      PID:2172
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF514.bat
                                                                                                                                                                                                                                                        112⤵
                                                                                                                                                                                                                                                          PID:6052
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                            113⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:4964
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF5DF.bat
                                                                                                                                                                                                                                                              114⤵
                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                              PID:4288
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                115⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                PID:2228
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF6AB.bat
                                                                                                                                                                                                                                                                  116⤵
                                                                                                                                                                                                                                                                    PID:5052
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                      117⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      PID:2716
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF737.bat
                                                                                                                                                                                                                                                                        118⤵
                                                                                                                                                                                                                                                                          PID:3064
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                            119⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                            PID:2060
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF7C4.bat
                                                                                                                                                                                                                                                                              120⤵
                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                              PID:4272
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                121⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                PID:4324
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF850.bat
                                                                                                                                                                                                                                                                                  122⤵
                                                                                                                                                                                                                                                                                    PID:2496
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                      123⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      PID:5936
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF8DD.bat
                                                                                                                                                                                                                                                                                        124⤵
                                                                                                                                                                                                                                                                                          PID:5908
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                            125⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            PID:2316
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF999.bat
                                                                                                                                                                                                                                                                                              126⤵
                                                                                                                                                                                                                                                                                                PID:4720
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                  127⤵
                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                  PID:3608
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA54.bat
                                                                                                                                                                                                                                                                                                    128⤵
                                                                                                                                                                                                                                                                                                      PID:3168
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                        129⤵
                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                        PID:2724
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFB10.bat
                                                                                                                                                                                                                                                                                                          130⤵
                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                          PID:2932
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                            131⤵
                                                                                                                                                                                                                                                                                                              PID:1456
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFBBB.bat
                                                                                                                                                                                                                                                                                                                132⤵
                                                                                                                                                                                                                                                                                                                  PID:4600
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                    133⤵
                                                                                                                                                                                                                                                                                                                      PID:1336
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC77.bat
                                                                                                                                                                                                                                                                                                                        134⤵
                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                        PID:3088
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                          135⤵
                                                                                                                                                                                                                                                                                                                            PID:2064
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFD23.bat
                                                                                                                                                                                                                                                                                                                              136⤵
                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                              PID:1840
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                137⤵
                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                PID:1252
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFDCF.bat
                                                                                                                                                                                                                                                                                                                                  138⤵
                                                                                                                                                                                                                                                                                                                                    PID:3312
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                      139⤵
                                                                                                                                                                                                                                                                                                                                        PID:1812
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFE9A.bat
                                                                                                                                                                                                                                                                                                                                          140⤵
                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                          PID:3172
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                            141⤵
                                                                                                                                                                                                                                                                                                                                              PID:5820
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFF46.bat
                                                                                                                                                                                                                                                                                                                                                142⤵
                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                PID:2620
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                  143⤵
                                                                                                                                                                                                                                                                                                                                                    PID:3188
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFFD2.bat
                                                                                                                                                                                                                                                                                                                                                      144⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                      PID:5416
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                        145⤵
                                                                                                                                                                                                                                                                                                                                                          PID:1172
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5F.bat
                                                                                                                                                                                                                                                                                                                                                            146⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                            PID:4772
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                              147⤵
                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                              PID:3548
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC.bat
                                                                                                                                                                                                                                                                                                                                                                148⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:4568
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                    149⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:956
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a159.bat
                                                                                                                                                                                                                                                                                                                                                                        150⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:4500
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                            151⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:3292
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1E6.bat
                                                                                                                                                                                                                                                                                                                                                                                152⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:5040
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                    153⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                    PID:3128
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2C0.bat
                                                                                                                                                                                                                                                                                                                                                                                      154⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:1696
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                          155⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                          PID:6004
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a37C.bat
                                                                                                                                                                                                                                                                                                                                                                                            156⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            PID:912
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                              157⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                              PID:3892
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a428.bat
                                                                                                                                                                                                                                                                                                                                                                                                158⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1776
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    159⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1852
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F3.bat
                                                                                                                                                                                                                                                                                                                                                                                                        160⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5232
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          161⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4112
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a57F.bat
                                                                                                                                                                                                                                                                                                                                                                                                            162⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2656
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:6020
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a60C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                  164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3692
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1452
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a689.bat
                                                                                                                                                                                                                                                                                                                                                                                                                        166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2476
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1020
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a716.bat
                                                                                                                                                                                                                                                                                                                                                                                                                            168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3328
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5744
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a793.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                  170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4612
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5540
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a810.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                          172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3792
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4940
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a88D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4204
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5960
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8FA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                      176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4104
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1944
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a977.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                          178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3956
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3208
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA71.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAEE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC55.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD01.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDAD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE88.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF24.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFEF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a107C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1109.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1186.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1212.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a128F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a131C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a13D7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1493.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a153F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a15DB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1677.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1704.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1781.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a17FE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a186B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a18D9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1946.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a19B3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1A21.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1ACD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1B78.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1C34.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1CB1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D2E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1DAB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1E18.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1E86.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1F03.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1F70.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1FCE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a204B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a20B8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2164.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a21F1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a227D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a230A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a23B6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2423.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2491.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a24EE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a255C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a25B9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2617.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a26A4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2730.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a27BD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a283A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a28E6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2973.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A0F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A8C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2AF9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  302⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      303⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B67.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          304⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            305⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2BC4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              306⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  307⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2C32.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    308⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        309⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2C8F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          310⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            311⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D1C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                312⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    313⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2DB8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        314⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          315⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E45.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              316⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  317⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2EC2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    318⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        319⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F3F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            320⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              321⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2FBC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  322⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      323⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3029.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          324⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            325⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a30A6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                326⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  327⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3133.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    328⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        329⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a31A0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          330⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              331⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4372
                                                                                                                                                                                                                                                            • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                              C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                              • Creates a file in the Startup directory
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                                                                                                                              • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                              PID:6024
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                PID:2608
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                    PID:1928

                                                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                                                  MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                  Reconnaissance

                                                                                                                                                                                                                                                                  Resource Development

                                                                                                                                                                                                                                                                  Initial Access

                                                                                                                                                                                                                                                                  Execution

                                                                                                                                                                                                                                                                  Command and Scripting Interpreter

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1059

                                                                                                                                                                                                                                                                  Windows Command Shell

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1059.003

                                                                                                                                                                                                                                                                  Persistence

                                                                                                                                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1547

                                                                                                                                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1547.001

                                                                                                                                                                                                                                                                  Privilege Escalation

                                                                                                                                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1547

                                                                                                                                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1547.001

                                                                                                                                                                                                                                                                  Defense Evasion

                                                                                                                                                                                                                                                                  Credential Access

                                                                                                                                                                                                                                                                  Credentials from Password Stores

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1555

                                                                                                                                                                                                                                                                  Credentials from Web Browsers

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1555.003

                                                                                                                                                                                                                                                                  Unsecured Credentials

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1552

                                                                                                                                                                                                                                                                  Credentials In Files

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1552.001

                                                                                                                                                                                                                                                                  Discovery

                                                                                                                                                                                                                                                                  Peripheral Device Discovery

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1120

                                                                                                                                                                                                                                                                  Query Registry

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1012

                                                                                                                                                                                                                                                                  System Information Discovery

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1082

                                                                                                                                                                                                                                                                  System Location Discovery

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1614

                                                                                                                                                                                                                                                                  System Language Discovery

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1614.001

                                                                                                                                                                                                                                                                  System Network Configuration Discovery

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1016

                                                                                                                                                                                                                                                                  Lateral Movement

                                                                                                                                                                                                                                                                  Collection

                                                                                                                                                                                                                                                                  Data from Local System

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1005

                                                                                                                                                                                                                                                                  Command and Control

                                                                                                                                                                                                                                                                  Exfiltration

                                                                                                                                                                                                                                                                  Impact

                                                                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                                                                  $$a6A1A.bat
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a6A1A.bat
                                                                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                                                                  • SHA256 2903909d53556b172db4ee3a14ad7bdeda10757d00274359d7a5b00cceb501d9
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  $$a6D08.bat
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a6D08.bat
                                                                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                                                                  • SHA256 0521a7490a6146ae7fb85ff684c5114c0137660611464fb90e1fed855cbfe8fc
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  $$a7277.bat
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a7277.bat
                                                                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                                                                  • SHA256 28ec719e5335e5b2307c95a85ba56aa82f6dfe197656528f0d2fd7c36f5a09e7
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  $$a769D.bat
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a769D.bat
                                                                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                                                                  • SHA256 bfe66c364d9912abac0f0c4436f3860166a42e461b346c317680294a2fa01c52
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  $$a7BED.bat
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a7BED.bat
                                                                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                                                                  • SHA256 ebfcb3a9d8c978f0fb27a7ff6ad3c3e9b09c57c9010ef138b39dfa6be89e3aba
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  $$a8052.bat
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a8052.bat
                                                                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                                                                  • SHA256 f36bed4e5046426c96fe4fb5eefcce51c5c9ad50857c4c303dc7edc29a062b12
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  $$a893B.bat
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a893B.bat
                                                                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                                                                  • SHA256 9fa64890be8ad6575b5531cc5c548cab7da77eb0c6b8011818d14c92e4228f39
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  $$a9B5C.bat
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a9B5C.bat
                                                                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                                                                  • SHA256 37f60450e306904993a7fefa52e7eabaa87ea14962469eafd81fc1a5f1fb3418
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  $$a9E1B.bat
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a9E1B.bat
                                                                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                                                                  • SHA256 d3438e5b05fe6ffa902685540e2471cc9109135313afba3599c25bf7d4d28869
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  $$aA33B.bat
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aA33B.bat
                                                                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                                                                  • SHA256 985adb45d206739945129c350eb734cc79b92c2a1a5403e4b28406ad0ddfce83
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  $$aA85C.bat
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aA85C.bat
                                                                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                                                                  • SHA256 f8bdd71cd064394203f07eef731a1c8e4bc69eda73b3845dbc02209b7f575f2d
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  $$aB22F.bat
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aB22F.bat
                                                                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                                                                  • SHA256 09a6a984b39cb4e3be4b0837b1b4ab2e04c4d04e6140d6e40aa8302140fb434f
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  $$aB6B4.bat
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aB6B4.bat
                                                                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                                                                  • SHA256 c7635a89850f9f79d2ff07596d2e714d63e80383d30400245a6158c2ad5b1946
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  $$aBB19.bat
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aBB19.bat
                                                                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                                                                  • SHA256 bff7e93a41d6116c421e52de0c8538e477b9bacd520d36d8cdd9ca8c99c9408a
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  $$aBF8D.bat
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aBF8D.bat
                                                                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                                                                  • SHA256 54eb373761d958bd4d15f82f06de680475448fcefec3b4993e2ee0070a34eaf4
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  $$aC3C3.bat
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aC3C3.bat
                                                                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                                                                  • SHA256 5b1f2acf7147f1a914863eaa759359e34a83dff2c74d714f9763ad6e5a18a3a9
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  $$aC857.bat
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aC857.bat
                                                                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                                                                  • SHA256 2964937a6adb8323f5c4c001eac7f3dc8b9f0a48fdf98c30b64dedb7fe85fe04
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  $$aCD78.bat
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aCD78.bat
                                                                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                                                                  • SHA256 c0f276d780d9af62932eb322e735422a48a037251256a4f480e0fd59cc8d7618
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  $$aD21B.bat
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aD21B.bat
                                                                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                                                                  • SHA256 4d489ee7d104c081db4097aa3a4815a30557f4a9ea8c3c502e931aef1422bcfb
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  $$aD5C5.bat
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aD5C5.bat
                                                                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                                                                  • SHA256 df82ab80747b417b5a8b67126779ab62ec6442645014a81f4a1706be0e1ace29
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  $$aD97E.bat
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aD97E.bat
                                                                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                                                                  • SHA256 2a3dd93bb7a8e969fbc28e14e40e82799f8b7e2c39de5bc7b95b19b50d3776a4
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe.exe
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe.exe
                                                                                                                                                                                                                                                                  • Size 5.6MB
                                                                                                                                                                                                                                                                  • SHA256 d0809381cf4eeb3bb895ddcdb9b2fe1de7697a52af959d4543d421a68a541d27
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe.exe
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe.exe
                                                                                                                                                                                                                                                                  • Size 5.5MB
                                                                                                                                                                                                                                                                  • SHA256 b93e4c8348f6a5215f386af6822d982e3445a0398f797b68a58a23845eabea81
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe.exe
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe.exe
                                                                                                                                                                                                                                                                  • Size 5.4MB
                                                                                                                                                                                                                                                                  • SHA256 e53fddaa2fe5877eaea32dc57b43645ed4f8b4aa81a5123d52b26291298037b2
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe.exe
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe.exe
                                                                                                                                                                                                                                                                  • Size 5.3MB
                                                                                                                                                                                                                                                                  • SHA256 5a647800b0ad7bdb459a1fdf7981985052e9074f28cfcbcf89e1bb410a2f444f
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe.exe
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe.exe
                                                                                                                                                                                                                                                                  • Size 5.4MB
                                                                                                                                                                                                                                                                  • SHA256 eb7c6196ee3e4cff8c2bdbf85a8ca29e3222d6a2c178585c0e73406d6f110bb0
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe.exe
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe.exe
                                                                                                                                                                                                                                                                  • Size 5.2MB
                                                                                                                                                                                                                                                                  • SHA256 fe250a8d0050db85525cb3e66ed20728ff5d86a92f66c8a091ee2bbafc0fe52c
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe.exe
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe.exe
                                                                                                                                                                                                                                                                  • Size 5.5MB
                                                                                                                                                                                                                                                                  • SHA256 4c621834aa88669af70b8847ea56998cc842d92ebce6794bb9138f7e88aa80b9
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe.exe
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe.exe
                                                                                                                                                                                                                                                                  • Size 5.2MB
                                                                                                                                                                                                                                                                  • SHA256 1356d5887cf6c66aea51a151838f27dde350115f541eba7038a182055925e962
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe.exe
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe.exe
                                                                                                                                                                                                                                                                  • Size 5.4MB
                                                                                                                                                                                                                                                                  • SHA256 635504f011e5dcdb4b3b77afe1e4bffe56ff9c6c42ea75d68269c1b6b6ee00dd
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe.exe
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe.exe
                                                                                                                                                                                                                                                                  • Size 5.1MB
                                                                                                                                                                                                                                                                  • SHA256 ac9818a32cf4f2ad347b417b57c5a3b26f53e90dd71c254ad9a752aa196f03e3
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe.exe
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe.exe
                                                                                                                                                                                                                                                                  • Size 5.3MB
                                                                                                                                                                                                                                                                  • SHA256 b9e9b8dbcda4294facfdda5e9831e102e2f949078d4dfec627158816ab21b092
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe.exe
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe.exe
                                                                                                                                                                                                                                                                  • Size 5.0MB
                                                                                                                                                                                                                                                                  • SHA256 1adee37be1691035e2805b2da805451156a5cf01807799df9168cf0293ef91cc
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe.exe
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe.exe
                                                                                                                                                                                                                                                                  • Size 5.5MB
                                                                                                                                                                                                                                                                  • SHA256 926fa0502a885c6b5e98e51a21a510255a63a4319d1492585da540d4decd6921
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe.exe
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe.exe
                                                                                                                                                                                                                                                                  • Size 5.3MB
                                                                                                                                                                                                                                                                  • SHA256 9b8ebb6a5f13a3fd17be16407e45a7a4599d687a4be8d8da20f37ff64f80b15d
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe.exe
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe.exe
                                                                                                                                                                                                                                                                  • Size 5.7MB
                                                                                                                                                                                                                                                                  • SHA256 bdbd176d630f5673b07c1995f24f8bd595666883a7c3a8d86a11e7ebd5370be6
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe.exe
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe.exe
                                                                                                                                                                                                                                                                  • Size 5.6MB
                                                                                                                                                                                                                                                                  • SHA256 6a22cb23b02bf869e20c822c0bffbfd726334e519b8b6567a3fdc723183f84fb
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe.exe
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe.exe
                                                                                                                                                                                                                                                                  • Size 5.2MB
                                                                                                                                                                                                                                                                  • SHA256 7c007e2bffecfb0d3b663567153b21f3f5083424a3534169b6afa84d17583733
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe.exe
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe.exe
                                                                                                                                                                                                                                                                  • Size 5.6MB
                                                                                                                                                                                                                                                                  • SHA256 facd4838cc2936e737849d65d082c8a480e7168abd524e6e55e68717b7d64eb9
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe.exe
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe.exe
                                                                                                                                                                                                                                                                  • Size 5.1MB
                                                                                                                                                                                                                                                                  • SHA256 47ecd288406c36438bfd8d9c69b6a9bc019d8548fda4ccbff0e6bf0c95cbca1d
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe.exe
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\c9d004c4e47b721d7cf22e4cea699a95a7ec3bddad6c8b15aafe53fd768c00a2.exe.exe
                                                                                                                                                                                                                                                                  • Size 5.1MB
                                                                                                                                                                                                                                                                  • SHA256 3294252a574bdd9869c7029b89d41772a20060fa54ce7d69ecca957b3364e2c2
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  Logo1_.exe
                                                                                                                                                                                                                                                                  • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                  • Size 32KB
                                                                                                                                                                                                                                                                  • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  _desktop.ini
                                                                                                                                                                                                                                                                  • Path F:\$RECYCLE.BIN\_desktop.ini
                                                                                                                                                                                                                                                                  • Size 10B
                                                                                                                                                                                                                                                                  • SHA256 6f32c14d8a0712d435829019df23525a5b62bb2ca9b24874a6316ec374b3d04c
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  memory/424-9068-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/460-8428-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/624-66-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/632-8970-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/836-8350-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/868-9152-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/956-8626-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/972-8956-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/1020-8690-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/1044-9089-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/1084-8362-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/1088-9124-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/1128-8998-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/1152-8344-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/1172-8612-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/1252-8584-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/1268-8886-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/1304-9166-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/1336-8570-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/1340-8907-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/1424-8823-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/1452-8682-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/1456-8563-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/1488-8914-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/1528-8774-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/1588-8243-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/1668-8788-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/1748-8307-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/1788-8893-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/1812-8591-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/1852-8661-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/1872-6029-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/1876-8865-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/1880-9033-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/1900-8977-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/1940-8464-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/1944-8725-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2060-8524-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2064-8577-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2084-9131-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2112-8301-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2168-8963-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2172-8500-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2180-6042-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2192-9040-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2228-8512-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2236-36-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2260-9026-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2280-8809-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2316-8542-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2352-8368-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2360-9082-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2384-8879-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2412-8386-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2556-8440-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2636-8434-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2716-8518-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2724-8556-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2740-8234-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2792-9012-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2852-24-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2892-9005-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2920-9096-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2948-8332-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2956-8844-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2968-8488-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2976-9138-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2996-9159-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/3004-9075-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/3040-205-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/3076-8781-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/3096-8320-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/3128-8640-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/3184-8204-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/3188-8605-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/3208-8732-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/3248-8410-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/3292-8633-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/3296-9054-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/3320-8452-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/3376-8795-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/3444-8928-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/3448-8760-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/3484-8416-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/3508-8225-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/3512-8802-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/3524-8858-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/3548-8619-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/3588-8476-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/3592-8404-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/3608-8549-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/3668-8288-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/3720-8746-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/3756-8991-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/3800-8942-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/3808-8356-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/3828-9061-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/3892-8654-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/3944-8326-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4056-8935-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4112-8668-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4120-8446-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4144-8458-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4216-8482-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4232-8494-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4252-8252-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4300-9110-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4316-8900-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4324-8530-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4356-8279-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4360-5550-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4364-8872-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4412-8753-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4444-8380-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4556-5559-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4676-9173-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4684-8984-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4712-8837-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4740-9019-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4764-8470-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4780-8215-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4804-8398-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4824-8422-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4860-8851-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4868-8261-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4880-9180-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4884-8816-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4940-8711-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4956-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4956-13-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4964-8506-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5124-8270-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5208-8921-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5272-8767-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5404-8313-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5428-8374-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5464-9117-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5540-8704-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5580-9047-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5612-1839-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5696-8830-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5736-9103-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5744-8697-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5768-9145-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5772-8338-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5800-8392-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5816-51-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5820-8598-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5876-8295-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5936-8536-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5960-8718-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5964-8739-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5976-8949-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/6004-8647-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/6020-8675-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/6024-3803-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/6024-849-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/6024-8219-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/6024-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/6032-9187-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                  Download